WordPress backup plugin hole leaves 3.25 million sites open to hijack
A flaw in All-in-One WP Migration and Backup lets unauthenticated attackers plant SQL that fires when an admin restores a backup, handing over full control of the site.
Key points
- A high-severity SQL injection flaw, tracked as CVE-2026-19949, affects the All-in-One WP Migration and Backup plugin for WordPress up to version 7.109.
- The plugin has more than five million active installs, and roughly 3.25 million sites are still running a vulnerable release.
- Researcher Jack Taylor reported the bug to Wordfence on 15 August; developer ServMask shipped a fix in version 7.110 on 20 August.
- An unauthenticated attacker can plant a malicious payload through WordPress trackbacks that fires when an admin exports and imports a site.
- Successful exploitation can end with full remote code execution and site takeover.
Millions of WordPress sites are running a backup plugin with a flaw that can hand attackers full control, and most of them still have not patched.
The plugin, All-in-One WP Migration and Backup, is a popular tool for copying an entire website, its database, images, themes and settings, from one server to another. It sits on more than five million sites, according to WordPress.org install counts.
The bug is tracked as CVE-2026-19949. Security researcher Jack Taylor found it and reported it in mid-August through Wordfence, the WordPress security arm of Defiant. BleepingComputer first covered the disclosure.
What is the flaw, in plain English?
It is an SQL injection, meaning an attacker can smuggle their own database commands into the site by hiding them inside ordinary-looking input. In this case the plugin mishandles backslashes and quotation marks when it rewrites the database during a restore.
Wordfence calls it a "second-order" injection. That label matters: the poisoned data sits quietly in the database and only detonates later, when an administrator runs an export and import.
How would an attacker actually pull this off?
They would send a specially crafted WordPress trackback, a type of automated comment WordPress accepts from other sites, to the target. The bad data lands in the database and waits.
When the admin next backs up and restores the site, the plugin processes that data as SQL. The injected commands can leak the plugin's secret import key, called ai1wm_secret_key, out through a public comment on the site.
With that key in hand, the attacker can upload a malicious .wpress archive containing executable code. At that point, Wordfence says, they can take over the site completely.
Who is affected and what has been patched?
Any site running All-in-One WP Migration and Backup up to and including 7.109 is exposed. ServMask, the plugin's developer, released version 7.110 on 20 August 2025 to fix it.
Uptake has been slow. Only about 35% of users have moved to the patched version, leaving roughly 3.25 million sites vulnerable.
| Detail | Value |
|---|---|
| CVE | CVE-2026-19949 |
| Affected versions | Up to 7.109 |
| Fixed in | 7.110 |
| Reported to Wordfence | 15 August 2025 |
| Patch released | 20 August 2025 |
| Vulnerable installs | ~3.25 million |
Should site owners and their visitors worry?
Yes, but the risk is not instant. The poisoned payload only fires when an admin performs a restore, so a site that never touches its backups today is not being taken over today. Given the plugin's whole purpose is backup and restore, though, that moment is coming.
A deactivated copy of the plugin is safer, but Wordfence warns it can still be triggered if an admin switches it on briefly.
If you run a WordPress site with this plugin, update to 7.110 now, before your next restore. If you are a customer of a small business whose site uses WordPress, there is nothing specific for you to do here, but treat unexpected password reset emails or account changes on any site with suspicion for the next few weeks.
Common questions
How do I check which version I have?
Log into your WordPress admin panel, open Plugins, and look for All-in-One WP Migration and Backup. The version number is listed under the plugin name.
Is turning the plugin off enough?
Not really. Deactivating lowers the risk, but the poisoned data can still sit in your database and trigger later. Updating to 7.110 is the fix.
