A high-severity WordPress backup plugin flaw could let unauthenticated attackers take control of vulnerable websites. The issue affects All-in-One WP Migration and Backup, a widely used tool with more than five million active installations.
Tracked as CVE-2026-19949, the vulnerability can lead to remote code execution when an administrator restores a site backup. ServMask fixed the issue in version 7.110, but millions of sites may still run vulnerable releases.
SQL injection flaw affects versions through 7.109
Security researcher Jack Taylor discovered the vulnerability and reported it through Wordfence in mid-August. Wordfence describes CVE-2026-19949 as a second-order SQL injection flaw affecting All-in-One WP Migration and Backup versions up to 7.109.
The WordPress backup plugin flaw stems from how the tool handles escaped backslashes and quotation marks while rewriting database content during archive restoration.
Attackers can plant malicious data through WordPress trackbacks. The payload then remains stored in the site’s database until an administrator exports and imports or restores the website.
That delay makes this attack different from an immediate compromise. However, backup restoration is a routine task for a plugin designed to move and recover entire WordPress sites.
Attack begins before the backup restore
An attacker can use the injected SQL to reveal the plugin’s secret import key through a public comment. With that key, the attacker could import a malicious .wpress archive containing executable code.
The archive could then run when an administrator performs a restore operation. Successful code execution could give the attacker complete control over the targeted WordPress website.
The vulnerability affects a plugin that handles databases, media files, themes and other core site content. As a result, a successful attack could expose both the website and the systems connected to it.
Millions of WordPress sites may remain vulnerable
All-in-One WP Migration and Backup has more than five million active installations. Yet only around 35% of users had updated to the fixed release after the patch became available.
That leaves an estimated 3.25 million websites on a vulnerable version of the plugin.
ServMask received Wordfence’s disclosure on August 15 and released the security update on August 20. Website owners should update All-in-One WP Migration and Backup to version 7.110 or later as soon as possible.
Administrators should also review recent trackbacks, public comments and unusual import activity. They should check for unexpected archives or unexplained changes to themes, plugins and administrator accounts.
Restore actions trigger the stored payload
The malicious SQL does not execute until an administrator restores a backup archive. At that point, the plugin processes the stored database content and may execute the payload.
This requirement reduces the chance of an instant attack. Still, it does not remove the risk because restoring backups is central to how the plugin works.
A deactivated vulnerable version presents less exposure. However, the WordPress backup plugin flaw can still pose a risk if an administrator temporarily enables it to recover or migrate a site.
Website owners should not delay updating. They should replace vulnerable versions before their next export, import or backup restoration task.
0 responses to “WordPress Backup Plugin Flaw Leaves Millions of Sites at Risk of Takeover”