Skip to content
Threat Feed
Subscribe
high advisory

SQL Injection in All-in-One WP Migration and Backup Plugin

An unauthenticated SQL injection vulnerability (CVE-2026-19949) in the All-in-One WP Migration and Backup plugin allows attackers to exfiltrate database contents, including secret keys, to facilitate remote code execution.

CVE search metadata

CVE search record: CVE-2026-19949. Severity: high. CVSS: 8.8. KEV: no. Product: All-in-One WP Migration and Backup (<= 7.109). Brief: SQL Injection in All-in-One WP Migration and Backup Plugin. Brief link: https://feed.craftedsignal.io/briefs/2026-08-cve-2026-19949/

The All-in-One WP Migration and Backup plugin for WordPress (up to version 7.109) contains a critical SQL injection vulnerability identified as CVE-2026-19949. The vulnerability exists within the archive restore functionality, where insufficient escaping of user-supplied parameters and improper preparation of SQL queries allow an unauthenticated attacker to manipulate database interactions. By injecting malicious SQL statements, an attacker can extract sensitive information directly from the WordPress database. A primary target for this exfiltration is the 'ai1wm_secret_key'. Once this key is obtained, it can be leveraged to bypass authentication or manipulate plugin operations, ultimately enabling remote code execution (RCE) on the host environment. This flaw presents a significant risk to WordPress installations utilizing this plugin, as it provides a clear path from initial unauthenticated access to full system compromise.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary data from the WordPress database. The exfiltration of the 'ai1wm_secret_key' can lead to complete site takeover via remote code execution, posing a risk of data theft, site defacement, or persistent unauthorized access across affected WordPress installations.

Recommendation

  • Immediately update the 'All-in-One WP Migration and Backup' plugin to the latest version (v7.110 or later) that contains the patch for CVE-2026-19949.
  • Audit WordPress database logs for unusual SQL patterns or unexpected queries originating from the webserver process user.
  • Monitor for unexpected administrative actions or plugin configuration changes following the restoration of site archives.
  • Implement a Web Application Firewall (WAF) rule to block POST requests containing common SQL injection payloads targeted at the plugin's restore endpoints.