ByThe All-in-One WP Migration vulnerability is a critical SQL injection flaw, tracked as CVE-2026-19949, that lets attackers plant malicious code inside a WordPress database and trigger it the next time a site owner restores a backup. It carries a CVSS score of 8.8 and touches one of the most widely used backup plugins in WordPress. If your site runs All-in-One WP Migration and Backup, updating to version 7.110 today is the single most important step you can take, and the seven fixes below walk through exactly how to do that safely, plus how to check whether an attacker already got in before you patched.
What Is the All-in-One WP Migration Vulnerability?
It is an unauthenticated, second-order SQL injection bug in the archive restore feature of All-in-One WP Migration and Backup, a plugin with more than 5 million active installs according to its WordPress.org listing. Security researchers assigned it CVE-2026-19949 after finding that the plugin fails to properly escape and prepare certain SQL queries used during the restore process.
The word “second-order” matters here. The attacker’s malicious input does not execute immediately. It sits quietly inside the site’s database, disguised as ordinary content, until an administrator later exports and re-imports the site using the plugin. That delay is what makes this bug harder to notice than a typical injection flaw.
According to SecurityWeek’s reporting, the flaw was patched in version 7.110 of the plugin, and the vendor has urged every site owner running an older release to update without delay.
Part of why this disclosure drew so much attention is timing. All-in-One WP Migration and Backup is a default recommendation in countless WordPress tutorials and hosting onboarding guides, precisely because it makes moving a site between servers simple. A flaw in a tool that popular does not just threaten a handful of niche sites, it threatens a meaningful slice of the entire WordPress ecosystem at once.
How Does CVE-2026-19949 Actually Work?
An attacker starts by submitting a specially crafted trackback or comment to any public post on the target site. Because trackbacks do not require authentication, this step needs no account and no login credentials at all. The payload looks harmless in the database and causes no immediate damage.
The real danger appears later. When a site administrator uses All-in-One WP Migration to export the site and then restores that export, the plugin’s restore routine reads the poisoned data back out of the database without sufficiently preparing the SQL statement around it. That gap is what lets the injected code run.
Researchers who reverse-engineered the flaw, including the writeup on SentinelOne’s vulnerability database, describe an escalation path where the attacker uses the injection to steal the plugin’s internal ai1wm_secret_key value during a restore. With that key in hand, an attacker can call the plugin’s own export and import endpoints directly and ultimately achieve remote code execution on the server.
In short: one crafted comment, one routine backup restore, and a site can go from fully patched-looking to fully compromised without anyone touching the wp-admin login screen.
This is also why signature-based malware scanners often miss the first stage. The payload sitting in the comments table does not look like PHP malware, it looks like ordinary, if garbled, visitor input. Most scanners are tuned to catch suspicious files, not suspicious database rows, so the trap can sit undetected for weeks before anyone runs a restore and triggers it.
Which Sites Are Actually at Risk?
Any WordPress site running All-in-One WP Migration and Backup on a version earlier than 7.110 is at risk, regardless of size or traffic. The plugin reports more than 5 million active installs, and reporting from SecurityWeek estimated that roughly 3.25 million of those sites were still running a vulnerable version as of September 2, 2026.
Sites that accept public comments or trackbacks carry extra exposure, since that is the entry point the attacker needs to plant the payload in the first place. Sites that restore backups regularly, such as agencies moving client sites between staging and production, face a shorter window between infection and exploitation.
Multisite networks deserve a closer look too. A single poisoned export file shared across a network, or reused as a template for new sites, can reintroduce the payload on every site that imports it, even after the original site has been patched.
Shared hosting adds another layer of risk. On a server where one account is compromised through this flaw, an attacker who achieves remote code execution may be able to pivot toward neighboring sites if the hosting environment does not properly isolate accounts from one another. This is one more reason to patch immediately rather than waiting for a convenient maintenance window.
Step 1: Check Which Version You Are Running
Log in to wp-admin, open Plugins, and find All-in-One WP Migration and Backup in the list. The installed version number appears directly under the plugin name. Anything below 7.110 is vulnerable to CVE-2026-19949 and needs to be updated immediately.
If you manage several sites, do not rely on memory. Use a staging or fleet dashboard, or simply repeat this check on each site’s Plugins screen, since even one unpatched install is enough to leave a client or network exposed.
You can also confirm the version from the command line if you have shell or WP-CLI access, which is faster than logging into wp-admin on every site in a large portfolio. Running wp plugin get all-in-one-wp-migration --field=version returns the installed version number in a single line, making it easy to script across dozens of sites at once.
Step 2: Update to Version 7.110 or Later
From the Plugins screen, click “Update Now” next to All-in-One WP Migration and Backup. This single action closes the SQL injection hole, because version 7.110 properly escapes and prepares the queries used in the restore process.
Take a full backup with a different, unaffected method before you update, such as a manual database export through your hosting control panel. That way, if anything about your existing site data looks unusual, you have a clean reference point to compare against.
After updating, confirm the version number shown in the Plugins list reads 7.110 or higher. If automatic updates are enabled for this plugin, check that the update actually completed rather than assuming it did, since a failed automatic update can silently leave the old, vulnerable files in place.
Step 3: Rotate Your ai1wm_secret_key
Because the exploit chain described by SentinelOne’s researchers relies on stealing the plugin’s ai1wm_secret_key, treat that key as compromised even after updating, especially if your site accepted public comments before you patched.
All-in-One WP Migration regenerates this key automatically when you deactivate and reactivate the plugin, or you can find the option to reset it under the plugin’s settings screen depending on your installed edition. Regenerating the key invalidates any copy an attacker may have already captured.
Do this step after updating to 7.110, not before, so the freshly generated key is protected by the patched code from the moment it is created.
Note the new key value somewhere safe if you use remote or scheduled backups that reference it, such as an external backup service tied to this plugin. Failing to update a saved reference can cause scheduled restores to fail silently until someone notices the backups have stopped completing.
Step 4: Audit Recent Comments and Trackbacks for Malicious Payloads
Since the attack begins with a crafted trackback or comment submitted to a public post, review your comments moderation queue and your published comments for anything unusual, especially entries with long strings of encoded characters or SQL-like syntax.
Delete anything suspicious rather than only marking it as spam, since spam folders still keep the underlying database rows in most configurations. If you use a security plugin with a web application firewall, check its logs for blocked requests targeting trackback or comment endpoints around the dates you noticed anything odd.
If your site has disabled trackbacks and pingbacks entirely, this step still matters, because ordinary comment forms can carry the same type of crafted payload if comment fields are not sanitized elsewhere on your site.
Step 5: Lock Down the Backups Directory
All-in-One WP Migration stores exported archives in a predictable wp-content/ai1wm-backups folder by default. Add an .htaccess rule, or an equivalent Nginx directive, that blocks direct web access to that directory so exported archives cannot be downloaded by anyone who guesses or finds the URL.
Delete old backup archives you no longer need. Every stored export is a potential copy of your poisoned data if it was created before you patched, and reducing the number of files in that folder reduces what an attacker could retrieve.
Step 6: Watch Your Site for Signs of Compromise
Check for new administrator accounts you did not create, unfamiliar scheduled tasks under Tools > Cron Events (with a cron management plugin), and unexpected files in your uploads folder, particularly PHP files where only images should exist.
Compare your current plugin and theme file list against a clean copy from the WordPress.org repository or your original theme package. A malware or file-integrity scanner can automate this comparison and flag anything that has been modified outside a normal update.
If you find any sign of compromise, treat the entire site as untrusted: rotate every password and API key, including database credentials, and consider restoring from a backup that predates the earliest suspicious comment you found in Step 4.
If your host provides WP-CLI access, running a checksum comparison against the official plugin and core files is faster than checking by hand. A command such as wp core verify-checksums and wp plugin verify-checksums --all flags any file that no longer matches the official WordPress.org copy, which is exactly the kind of tampering a web shell would leave behind.
What If I Already Restored a Backup After Being Infected?
Assume the restore triggered the exploit and move straight to incident response rather than just patching and hoping. Take the site offline or put it in maintenance mode first, so any web shell the attacker planted cannot be used while you investigate.
Pull a fresh copy of WordPress core, your theme, and every plugin from their official sources, then compare file-by-file against what is currently on the server rather than trusting an in-place update to remove anything malicious. Anything that does not match gets deleted and replaced, not patched.
Change every credential tied to the site: WordPress admin passwords, database user password, hosting control panel password, and any API keys stored in plugin settings. Only bring the site back online once you have confirmed a clean file set, a rotated ai1wm_secret_key, and no unfamiliar administrator accounts.
Step 7: Build a Patching Routine So This Does Not Happen Again
Turn on automatic updates for security-sensitive plugins like backup and migration tools, or at minimum, check for updates weekly rather than waiting for a plugin to stop working. CVE-2026-19949 sat unpatched on millions of sites for weeks after a fix was already available.
Subscribe to a vulnerability feed such as Wordfence’s intelligence database or the WordPress Vulnerability Disclosure Program updates so you learn about critical plugin flaws within hours instead of months. Pair that habit with the WordPress core hardening steps covered in our WordPress 7.1 breaking changes guide to keep your whole stack current.
How Does This Compare to Other 2026 WordPress Plugin Vulnerabilities?
CVE-2026-19949 is far from the only critical plugin flaw disclosed this year, but its combination of scale and stealth sets it apart. The table below lines it up against three other significant 2026 disclosures for comparison.
| Plugin | Vulnerability Type | CVSS Score | Estimated Sites Affected | Fixed Version |
|---|---|---|---|---|
| All-in-One WP Migration and Backup | Second-order SQL injection | 8.8 | ~3.25 million | 7.110 |
| Forminator | Arbitrary file upload | 9.8 | 500,000+ | See our Forminator guide |
| WPForms Lite | Backdoor / supply chain | 9.8 | Unspecified (large) | See our WPForms guide |
| Kirki | Remote code execution | 9.0+ | 700,000+ | See our Kirki guide |
Two patterns stand out across all four cases: the most dangerous flaws require no authentication at all, and the plugins involved are trusted, mainstream tools rather than obscure add-ons. That combination is exactly why a fast patching routine matters more than trying to guess which plugins are “risky” in advance.
Frequently Asked Questions
Is my site infected just because I have an old version of the plugin installed?
No. Running a vulnerable version means your site is exposed, not necessarily compromised. Exploitation requires an attacker to submit a crafted comment or trackback and then wait for an administrator to run a restore. Update to 7.110 and complete the audit steps above to confirm there was no exploitation.
Do I need to reinstall WordPress after patching this vulnerability?
Not in most cases. Updating the plugin to version 7.110, rotating the ai1wm_secret_key, and auditing comments and file integrity is sufficient if you find no evidence of compromise. A full WordPress reinstall is only necessary if your investigation turns up a confirmed backdoor or unauthorized admin account.
Can I just deactivate All-in-One WP Migration instead of updating it?
Deactivating the plugin removes the restore code path that this vulnerability exploits, which does stop new exploitation. However, it does not remove any malicious data already sitting in your comments table, so you still need to complete the audit in Step 4 either way.
Does disabling comments on my site fully protect me from CVE-2026-19949?
It closes the most common entry point, since the attack relies on submitting a crafted trackback or comment. It does not replace updating the plugin, because other input fields that reach the same vulnerable database code could theoretically be abused in similar ways.
How do I know if version 7.110 actually fixed the issue on my site?
Check the Plugins screen to confirm the installed version reads 7.110 or higher, then review the plugin’s changelog on WordPress.org, which documents the SQL injection fix for that release. Running a reputable security scanner afterward adds an extra layer of confidence.
Reporting on CVE-2026-19949 describes the flaw as present in the core restore functionality shared across the plugin’s editions, so both the free WordPress.org version and the premium ServMask editions should be updated to a patched release without assuming either one is exempt. If you run a premium extension bundle on top of the base plugin, update that bundle too, since extensions typically pin to a specific core version and will not benefit from the fix until they are refreshed alongside it.
Final Thoughts on the All-in-One WP Migration Vulnerability
The All-in-One WP Migration vulnerability is a reminder that even routine, everyday plugin actions like backups and restores can become an attack surface. Update to version 7.110, rotate the secret key, audit your comments, and lock down your backups folder, and you close every stage of this particular attack chain.
None of these steps require special tools or a security background, just a checklist and roughly thirty minutes per site. That is a small price for avoiding a full site takeover. For more on protecting your site from this year’s other major disclosures, see our guides on the Forminator Forms vulnerability and the WPForms Lite backdoor.
Subscribe for Newsletter
