A serious vulnerability in the WordPress plugin “All-in-One WP Migration and Backup” threatens more than five million active websites. Security firm Wordfence publicly disclosed the flaw, tracked as CVE-2026-19949, on 3 September 2026. Rated 8.8 (high) on the CVSS scale, it now has an available patch.
What attackers can exploit
According to Wordfence, the issue is an unauthenticated second-order SQL injection in the plugin’s restore process. Attackers first plant crafted trackback data via public post pings, which WordPress stores harmlessly. When administrators later export and restore a site, a defect in the plugin’s URL-rewriting logic causes the stored payload to break out of its intended SQL string boundary. That lets the injected code retrieve the secret key used for unauthenticated imports – opening the door to full site takeover.
Affected versions and the fix
All versions up to and including 7.109 are vulnerable. The cleaned-up release 7.110 resolves the problem. The flaw was found by security researcher Jack Taylor, who reported it on 14 August 2026 through the Wordfence Bug Bounty Program and received a 5,761 US-dollar reward.
- Update the plugin to version 7.110 or later without delay.
- After updating, review unneeded trackbacks and suspicious comment entries.
- Restore backups only from trusted sources.
Assessment
Wordfence says no active attacks against CVE-2026-19949 have been observed so far. Given the plugin’s huge install base and the fact that the technical details are now public, prompt patching is nonetheless considered urgent. Two-stage attacks of this kind often go unnoticed for a long time because the actual payload only fires during a later restore operation.
Sources: Wordfence · NVD · Cybersecurity News
