Backup Turned Weapon: How the All-in-One WP Migration Plugin Exposes 3.2 Million Sites

A high-severity vulnerability in the All-in-One WP Migration and Backup plugin puts roughly 3.2 million WordPress sites at risk. The flaw, tracked as CVE-2026-19949 with a CVSS score of 8.8, allows an unauthenticated attacker to achieve remote code execution through a multi-step chain that exploits the archive restore function itself.

The Attack Chain: From Trackback to RCE

The vulnerability is a second-order SQL injection. The payload does not trigger immediately: the attacker plants crafted data by exploiting WordPress trackbacks, a legacy feature that enables cross-blog notifications. This data survives serialization inside a .wpress archive.

When the administrator performs an archive restore — a routine operation for a backup plugin — the SQL payload activates during the rewriting of database URLs and prefixes. The SQL compromise yields the ai1wm_secret_key. With this key, the attacker imports an arbitrary .wpress archive containing a must-use (MU) plugin, achieving persistent remote code execution.

The plugin has over 5 million active installations on WordPress.org. The estimate of roughly 3.2 million unpatched sites is based on the 35% update rate recorded as of September 3, 2026, according to data reported by SecurityWeek.

The Update Lag Amplifying Risk

Patch 7.110 was released on August 20, 2026, five days after disclosure to vendor ServMask on August 15 via Wordfence. The CVE publication on NVD is dated August 25. Despite this window, the majority of users had not updated as of September 3.

This lag is not unusual for the WordPress ecosystem, where plugins with massive install bases see patch adoption curves stretching over weeks or months. However, in this specific case, the combination of an unauthenticated attack vector with a core plugin function amplifies the exposure surface.

"As with all remote code execution vulnerabilities, this can lead to complete site compromise through the use of webshells and other techniques" — Defiant, via SecurityWeek

The Structural Paradox: When Backup Becomes the Vector

The severity of the vulnerability lies in the overlap between legitimate function and attack vector. All-in-One WP Migration is designed to simplify complex operations — backup, migration, cloning — that require deep database access. This architecture, which makes it popular with non-specialist users, simultaneously expands the privileges available to an eventual exploit.

The second-order nature of the SQL injection bypasses controls that typically filter direct input: the payload traverses archive serialization and manifests only in a later operational phase, when the administrator performs a legitimate action. According to Wordfence, reported by BleepingComputer: "Since backup and restore is the core purpose of this plugin, this is a routine action, but the injected SQL will not execute until it takes place." The quote, translated from English, indicates the attack blends with normal use until the moment of activation.

According to SentinelOne analysis, the root cause lies in insufficient user input escaping combined with a lack of SQL query preparation in the archive restore files. It should be noted that SentinelOne classifies the attacker as "Authenticated attackers with low privileges," a description that conflicts with primary sources: SecurityWeek, BleepingComputer, and Wordfence agree in describing the vector as unauthenticated. Primary sources prevail in the risk assessment.

What to Do Now

• Update immediately to version 7.110: the fixed patch has been available in the WordPress.org repository since August 20, 2026
• Deactivate if not needed: temporary deactivation reduces risk, but the vulnerability persists if the plugin is reactivated without updating
• Check trackback logs: look for suspicious trackbacks inserted before the patch as an indicator of possible attack preparation
• Monitor for unauthorized .wpress imports: extraction of the ai1wm_secret_key is the critical step enabling RCE; detect anomalous archive imports

Status on Exploitation Confirmation

No independent confirmations of active in-the-wild exploitation have emerged to date. SOCRadar reports that exploitation is signaled but lacks independent confirmation — a condition that currently excludes inclusion in catalogs such as the CISA Known Exploited Vulnerabilities, but does not diminish patching priority given the severity of the mechanism.

The vulnerability was discovered by researcher Jack Taylor through the Wordfence program, with disclosure to ServMask on August 15, 2026. The vendor's rapid response — patch in five days — contrasts with slow user adoption, a recurring pattern in the WordPress ecosystem that leaves exposure windows measured in weeks or months.

Information has been verified on SecurityWeek (Defiant/Wordfence), BleepingComputer, and supporting sources, and updated at the time of publication.

Information has been verified on the cited sources and updated at the time of publication.

Sources

• https://www.securityweek.com/over-3-million-wordpress-sites-affected-by-migration-plugin-vulnerability/
• https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/
• https://www.sentinelone.com/vulnerability-database/cve-2026-19949/
• https://socradar.io/free-tools/cve-radar/CVE-2026-19949
• https://www.hendryadrian.com/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/
• https://www.searchenginejournal.com/updraftplus-wordpress-vulnerability-puts-3-million-sites-at-risk/578912/
• https://podcast.securityweek.com/