Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
CVE-2026-19949 is a high-severity (CVSS 8.8) second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin, affecting versions up to 7.109 The exploit chain leverages WordPress core's trackback functionality to inject malicious payloads that, after archive import, promote attacker input into executable SQL to exfiltrate the secret restore key With only 35% of installations updated to the patched version 7.110, approximately 3.2 million websites remain vulner
Analysis
TL;DR
- CVE-2026-19949 is a high-severity (CVSS 8.8) second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin, affecting versions up to 7.109
- The exploit chain leverages WordPress core's trackback functionality to inject malicious payloads that, after archive import, promote attacker input into executable SQL to exfiltrate the secret restore key
- With only 35% of installations updated to the patched version 7.110, approximately 3.2 million websites remain vulnerable to unauthenticated remote code execution
- Attackers can retrieve the stolen secret key via the comments REST API endpoint and use it to import a crafted .wpress archive containing a malicious must-use plugin, achieving full site compromise
Why It Matters
This vulnerability demonstrates how a second-order SQL injection in a widely deployed WordPress plugin can be chained with core WordPress functionality to achieve unauthenticated RCE, affecting millions of sites. The extremely low patch adoption rate (35%) highlights the critical gap between vulnerability disclosure and real-world remediation, making this an active exploitation risk for threat actors targeting the WordPress ecosystem.
Technical Details
- Vulnerability Type: Second-order SQL injection (CVE-2026-19949, CVSS 8.8) in the archive restore functionality of All-in-One WP Migration and Backup
- Root Cause: User-supplied input from WordPress trackbacks is insufficiently escaped and SQL queries are not properly prepared; backslashes are not stripped and URLs are not rejected during input handling
- Exploit Chain: (1) Attacker submits two trackbacks with trailing backslashes and payload URLs to a public post; (2) During archive import, the plugin rewrites URLs and table prefixes in stored SQL, promoting attacker input to executable SQL; (3) The secret restore key is written to an approved, publicly visible comment; (4) Attacker retrieves the key via the comments REST API; (5) Attacker imports a crafted .wpress archive containing a malicious must-use plugin, achieving RCE on next page load
- Patch: Version 7.110, released August 20; all versions up to 7.109 are affected
- Scope: Plugin has over 5 million active deployments; ~3.2 million installations remain vulnerable as of September 3
Industry Insight
- WordPress site operators should prioritize immediate patching of the All-in-One WP Migration and Backup plugin to version 7.110, as the low adoption rate indicates many sites remain exposed to active exploitation
- This vulnerability underscores the importance of input sanitization and prepared statements even in unauthenticated import flows, where attacker-controlled data can persist and execute later during restore operations
- Security teams should audit WordPress installations for any custom or third-party plugins that handle user-supplied input in database operations without proper escaping, as second-order injection patterns are a common but often overlooked attack surface
Disclaimer: The above content is generated by AI and is for reference only.