Reported by 4 outlets

Timeline

1. original reporting

   WordPress backup plugin flaw exposes millions of sites to takeover attacks

   bleepingcomputer.com · 41d ago · September 2nd, 2026

   An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites. The plugin is used to back up, export, import, and move entire websites, including their databases, media, themes, and plugins, between servers or domains. The security flaw is tracked as CVE-2026-19949 and received a high-severity score. It was discovered by security researcher Jack Taylor, who reported it in mid-August through Defiant's cybersecurity branch, Wordfence. In a report yesterday, Wordfence researchers say that CVE-2026-19949 is a second-order SQL injection vulnerability that impacts All-in-One WP Migration and Backup versions throuhg 7.109. The issue consists of incorrect parsing of escaped backslashes and quotation marks while the plugin rewrites database content during archive restoration. An unauthenticated attacker could plant crafted data through WordPress trackbacks, which would execute when an administrator exports and imports the site, both common operations for the plugin. The injected SQL can expose the plugin’s secret import key (ai1wm_secret_key) through a public comment, allowing the attacker to obtain it and import a malicious ‘.wpress’ archive containing executable code. Wordfence mentions that code execution at this privilege level may lead to taking complete control of the target website. According to statistics from WordPress.org , All-in-One WP Migratio

2. update from cyberpress.org

   WordPress Plugin Flaw Lets Attackers Turn SQL Injection Into Complete Site Takeover

   cyberpress.org · 40d ago · September 3rd, 2026

   Tracked as CVE-2026-19949, the issue affects plugin versions 7.109 and earlier, which are installed on more than 5 million WordPress sites. Developer ServMask addressed the flaw in version 7.110, released on August 20, 2026. Unlike direct SQL injection attacks , the malicious input does not execute immediately. Instead, an attacker first stores a crafted payload in a vulnerable application component, where it remains dormant until a later action processes it in an unsafe way. In this case, threat actors can use WordPress trackbacks to submit malicious values to public posts that allow pings. The attacker-controlled blog name and URL are saved in the WordPress comments database table. The injection becomes active only after a site administrator exports and then restores an archive using the All-in-One WP Migration and Backup plugin. The plugin packages sites into proprietary .wpress archives containing files and database data. During restoration, it rewrites URLs and database table prefixes within SQL sta

3. update from gbhackers.com

   WordPress Plugin Flaw Lets Attackers Turn SQL Injection Into Complete Site Takeover

   gbhackers.com · 40d ago · September 3rd, 2026

   A high-severity vulnerability affecting over 5 million active WordPress installations could allow unauthenticated attackers to exploit stored SQL injection vulnerabilities, leading to remote code execution and complete website takeover. Wordfence has rated the vulnerability 8.8 out of […] The post WordPress Plugin Flaw Lets Attackers Turn SQL Injection Into Complete Site Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from securityweek.com

   Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

   securityweek.com · 40d ago · September 3rd, 2026

   The flaw exists because user-supplied input is insufficiently escaped and existing SQL queries are not sufficiently prepared, Defiant explains . An attacker could supply malicious content via WordPress core’s trackback functionality to extract the secret key used during an archive restore operation, and then use the key to deploy a malicious plugin for RCE. CVE-2026-19949 allows an attacker to submit two trackbacks to a public post, each carrying a trailing backslash and a URL leading to a payload. The input is saved without backslashes being stripped or the URLs being rejected.