All-in-One WP Migration Flaw Hits 3M WordPress Sites

Three million WordPress sites running the All-in-One WP Migration and Backup plugin are exposed to an unauthenticated SQL injection, CVE-2026-19949, CVSS 8.8 (high), affecting all plugin versions through 7.109. The NVD published the advisory on August 25, 2026; SecurityWeek reported on the exposure’s scale this week. Sites should update beyond version 7.109 immediately.

How it works

The flaw lives in the plugin’s archive restore functionality. The plugin passes a user-supplied parameter directly to a database query without sufficient escaping or preparation, so an unauthenticated attacker can append SQL of their choosing. What an attacker can pull from the database includes the plugin’s internal ai1wm_secret_key value. Per the NVD advisory, that key then provides a path to remote code execution, exploitable once an administrator triggers an archive restore operation.

The CVSS score lands at 8.8 rather than 9.8 because the exploitation path is not fully autonomous: the restore window has to be active. That constraint limits opportunistic mass-scanning, but it does not close the risk for sites running scheduled migrations or backups. An attacker with access to timing information, or one who can prompt an admin into initiating a restore, has a workable path.

What to do

Update the All-in-One WP Migration and Backup plugin to any version above 7.109. Sites with automatic plugin updates enabled will receive the fix without manual action. Everyone else: open the Plugins dashboard and apply the update.

This is another high-severity WordPress plugin vulnerability in a month that has also seen CVE-2026-32475 in Elementor Pro and CVE-2026-82607 in Profile Builder. The fix is never complicated. Whether three million site owners apply it before someone starts scanning for active restore windows is a different question.