WordPress backup plugin hole leaves 3.25 million sites open to hijack

Key points

• A high-severity SQL injection flaw, tracked as CVE-2026-19949, affects the All-in-One WP Migration and Backup plugin for WordPress up to version 7.109.
• The plugin has more than five million active installs, and roughly 3.25 million sites are still running a vulnerable release.
• Researcher Jack Taylor reported the bug to Wordfence on 15 August; developer ServMask shipped a fix in version 7.110 on 20 August.
• An unauthenticated attacker can plant a malicious payload through WordPress trackbacks that fires when an admin exports and imports a site.
• Successful exploitation can end with full remote code execution and site takeover.

Millions of WordPress sites are running a backup plugin with a flaw that can hand attackers full control, and most haven't patched.

The plugin, All-in-One WP Migration and Backup, copies an entire website, its database along with images and themes, from one server to another. It sits on more than five million sites, according to WordPress.org install counts.

The bug is tracked as CVE-2026-19949. Security researcher Jack Taylor found it and reported it in mid-August through Wordfence, the WordPress security arm of Defiant. BleepingComputer first covered the disclosure.

What is the flaw, in plain English?

It's an SQL injection, meaning an attacker can smuggle their own database commands into the site by hiding them inside ordinary-looking input. The plugin mishandles backslashes and quotation marks when it rewrites the database during a restore.

Wordfence calls it a "second-order" injection. That label matters: the poisoned data sits quietly in the database and only detonates later, when an administrator runs an export and import.

How would an attacker actually pull this off?

They'd send a specially crafted WordPress trackback, a type of automated comment WordPress accepts from other sites, to the target. The bad data lands in the database and waits.

When the admin next backs up and restores the site, the plugin processes that data as SQL. The injected commands can leak the plugin's secret import key, called ai1wm_secret_key, out through a public comment on the site.

With that key in hand, the attacker can upload a malicious .wpress archive containing executable code. At that point, Wordfence says, they can take over the site completely.

Who is affected and what has been patched?

Any site running All-in-One WP Migration and Backup up to and including version 7.109 is exposed. ServMask released version 7.110 on 20 August 2026 to fix it.

Uptake has been slow. Only about 35% of users have moved to the patched version, leaving roughly 3.25 million sites vulnerable. WordPress plugin patching tends to lag, as we've seen repeatedly covering Wordfence disclosures, including the Avada theme chain we reported on 26 August.

Should site owners and their visitors worry?

Yes, but the risk isn't instant. The poisoned payload only fires when an admin performs a restore, so a site that never touches its backups today isn't being taken over today. Given the plugin's whole purpose is backup and restore, though, that moment is coming.

A deactivated copy of the plugin is safer, but Wordfence warns it can still be triggered if an admin switches it on briefly.

Update to 7.110 now, before your next restore. Visitors to sites running WordPress should treat unexpected password reset emails or account changes with suspicion over the next few weeks.

Common questions

How do I check which version I have?

Log into your WordPress admin panel and look for All-in-One WP Migration and Backup under Plugins. The version number is listed under the plugin name.

Is turning the plugin off enough?

Not really. Deactivating lowers the risk, but the poisoned data can still sit in your database and trigger later. Updating to 7.110 is the fix.