The **All-in-One WP Migration** and **Backup** plugin, widely used for backing up, exporting, importing, and migrating entire **WordPress** websites, is at the center of a critical security alert. A newly discovered SQL injection flaw, **CVE-2026-19949**, enables unauthenticated attackers to potentially compromise millions of sites. ### The Vulnerability Explained Discovered by security researcher **Jack Taylor** and reported to **Wordfence** (Defiant's cybersecurity branch) in mid-August, **CVE-2026-19949** is a second-order SQL injection vulnerability. It impacts **All-in-One WP Migration** and **Backup** versions up to 7.109. The flaw stems from incorrect parsing of escaped backslashes and quotation marks during the plugin's database content rewriting process when restoring an archive. An attacker can plant crafted data via **WordPress** trackbacks. This malicious data then executes when an administrator performs a site export and import – common operations for the plugin. Successful exploitation can expose the plugin's secret import key (`ai1wm_secret_key`) through a public comment. With this key, attackers can import a malicious `.wpress` archive containing executable code, potentially leading to complete control of the target website. ### Widespread Exposure With over five million active installations, the **All-in-One WP Migration** and **Backup** plugin represents a significant attack surface. While the vendor, **ServMask**, addressed the vulnerability in version 7.110 on August 20, a concerning number of sites remain exposed. **Wordfence** reports that only approximately 35% of the plugin’s user base has updated to the latest version. This leaves an estimated 3.25 million **WordPress** sites running a vulnerable release, highlighting a critical patch management challenge.  ### Admin Action Required for Exploitation The exploit's payload remains dormant until an administrator restores a backup archive. This action triggers the processing of SQL string boundaries, executing the stored malicious data as SQL. While this prerequisite lessens the immediate risk, **Wordfence** emphasizes that backup and restore operations are core functions of the plugin, making administrator action inevitable. “Since backup and restore is the core purpose of this plugin, this is a routine action, but the injected SQL will not execute until it takes place,” **Wordfence** noted in their report. Even a deactivated vulnerable version of the plugin poses a risk if it is temporarily activated. **WordPress** administrators and users of the **All-in-One WP Migration** and **Backup** plugin are strongly urged to update to version 7.110 or higher immediately to mitigate this severe risk.