SQL Injection Vulnerability in All-in-One WP Migration Plugin for WordPress
CVE-2026-19949
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 August 2026
Badges
What is CVE-2026-19949?
The All-in-One WP Migration and Backup plugin for WordPress contains a SQL injection vulnerability due to inadequate input escaping during the archive restore process. This flaw allows unauthenticated attackers to insert malicious SQL commands into existing queries. As a result, they can potentially gain access to sensitive information, such as the ai1wm_secret_key, particularly when a site administrator is restoring an archive. If an attacker successfully retrieves this key, they could exploit it for remote code execution, compromising the security of the WordPress site.
Affected Version(s)
All-in-One WP Migration and Backup 0 <= 7.109
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
WordPress backup plugin flaw exposes millions of sites to takeover attacks
An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites.
2 weeks ago
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
- 📰
First article discovered by BleepingComputer
Vulnerability published
Vulnerability Reserved