SQL Injection Vulnerability in All-in-One WP Migration Plugin for WordPress

CVE-2026-19949

What is CVE-2026-19949?

The All-in-One WP Migration and Backup plugin for WordPress contains a SQL injection vulnerability due to inadequate input escaping during the archive restore process. This flaw allows unauthenticated attackers to insert malicious SQL commands into existing queries. As a result, they can potentially gain access to sensitive information, such as the ai1wm_secret_key, particularly when a site administrator is restoring an archive. If an attacker successfully retrieves this key, they could exploit it for remote code execution, compromising the security of the WordPress site.

References