More than three million WordPress websites may remain exposed to takeover attacks because of a high-severity flaw in the All-in-One WP Migration and Backup plugin, security researchers have warned.
The vulnerability, identified as CVE-2026-19949, affects versions up to and including 7.109 of the plugin, which is used to back up, transfer and restore websites, including their databases, themes, media and other extensions.
Researchers at Wordfence, the security division of Defiant, said the bug could allow an unauthenticated attacker to plant malicious data on a site and ultimately execute code with sufficient privileges to take complete control of it.
The flaw was discovered by security researcher Jack Taylor and reported to Wordfence in mid-August. After validating the finding, Wordfence notified the plugin’s developer, ServMask, on 15 August.
ServMask released version 7.110 on 20 August to address the vulnerability. However, WordPress.org figures indicate that only about 35 per cent of the plugin’s users have installed the fixed version, leaving an estimated 3.25 million sites running a vulnerable release.
How the WordPress plugin flaw can be exploited
Wordfence described CVE-2026-19949 as a second-order SQL injection vulnerability. It is linked to the way the plugin handles escaped backslashes and quotation marks when rewriting database content during the restoration of a backup archive.
An attacker can insert specially crafted data through WordPress trackbacks. The malicious content remains inactive until an administrator exports and then imports the site, at which point the plugin processes the stored data as SQL.
The resulting database operation can expose the plugin’s secret import key, known as ai1wm_secret_key, through a publicly visible comment. With that key, an attacker could import a malicious “.wpress” archive containing executable code.
Because restoring a backup is a normal function of the plugin, the requirement for an administrator to carry out the action does not remove the risk. “Since backup and restore is the core purpose of this plugin, this is a routine action, but the injected SQL will not execute until it takes place,” Wordfence said.
A deactivated installation is less exposed, according to the researchers, but could still be targeted if the vulnerable plugin is temporarily switched on.
Administrators using All-in-One WP Migration and Backup should update to version 7.110 or later. The scale of the remaining unpatched user base means vulnerable installations could continue to present an opportunity for attackers.
