A serious WordPress security issue is putting millions of websites at risk. The All-in-One WP Migration and Backup plugin has a high-severity vulnerability that can allow an unauthenticated attacker to work toward full server-level code execution, and public exploit material is reportedly circulating.
Table of Contents
- What is the WordPress flaw?
- Who is affected?
- Why the risk is serious
- What site owners should do
- How to check for trouble
What is the WordPress flaw?
The vulnerability is tracked as CVE-2026-19949 and affects All-in-One WP Migration and Backup versions through 7.109. Security reporting describes it as a second-order SQL injection: malicious data can be stored first and then activated later when the plugin processes database content during a backup or restore operation.
The plugin developer released version 7.110 to address the issue. Because the vulnerable component is designed to export and restore a complete WordPress installation, a successful attack could have consequences far beyond one stolen setting.
Who is affected?
Any WordPress site with an affected version installed is potentially exposed, including sites where the plugin is not currently active but remains available on the server. The plugin is widely used by bloggers, agencies, freelancers, and businesses to move or restore sites.
Reported figures indicate that millions of installations exist and that a large share had not yet applied the patch when the vulnerability received public attention. That makes this a practical maintenance issue, not a vulnerability that only affects unusually configured websites.
Why the risk is serious
The reported attack chain can begin without a valid WordPress account. An attacker may plant crafted data through a public-facing feature, wait for a site administrator to run a migration or restore task, and then attempt to abuse the plugin’s processing of that stored data.
Security researchers have described a path that could expose an import key and ultimately allow a malicious backup archive to be uploaded. If successful, that could give an attacker the ability to install persistent malware, redirect visitors, steal information, or damage the site.
A web application firewall should not be treated as a complete fix. Second-order attacks can separate the moment data is submitted from the moment it is executed, making the malicious sequence harder for request-based defenses to recognize.
What site owners should do
- Update immediately. Upgrade All-in-One WP Migration and Backup to version 7.110 or the newest release offered by the developer.
- Remove unused copies. Deactivate and delete old plugin installations, staging copies, and abandoned WordPress sites you no longer manage.
- Review administrator activity. Look for unexpected imports, exports, new users, changed passwords, unfamiliar plugins, or modified files.
- Rotate important credentials. Change WordPress administrator, hosting, database, FTP, and API credentials if compromise is suspected.
- Keep an offline or protected backup. Make sure at least one clean backup cannot be overwritten by a compromised site.
How to check for trouble
Start in WordPress under Plugins and confirm the installed version. Then inspect recent administrator logins, media uploads, scheduled tasks, newly created accounts, and changes inside wp-content. Pay special attention to unfamiliar must-use plugins and files that appeared after a migration or restore.
If you find evidence of unauthorized access, take the site offline or place it behind maintenance protection, contact your hosting provider, and preserve logs before cleaning anything. Do not assume that reinstalling one plugin removes a backdoor.
This is another reminder that WordPress security depends on regular updates and careful plugin management. For more practical mobile security advice, read our guides on Android security protections and protecting your phone from banking trojans.
Sources: Patchstack vulnerability database; Tech Times report.