CVE-2026-19949: SQL injection flaw in All-in-One WP Migration, 3.2m sites still at risk

Anyone managing WordPress hosting for third parties has all the more reason to check today, Tuesday 13 October 2026, the list of plugins installed on client sites. The Wordfence bulletin, the security division of Defiant, describes a vulnerability in the All-in-One WP Migration and Backup plugin by ServMask, installed on over 5 million active sites according to WordPress.org data.

The CVE and score

The flaw is tracked as CVE-2026-19949, with CVSS 8.8 (high). The CVSS v3.1 base score is 8.8, severity HIGH, with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This is a second-order SQL injection defect in the plugin's archive restoration functionality.

How the attack works

The mechanism is not immediate, and this makes it more insidious to spot in logs. An attacker can first store malicious input in the WordPress database, then wait for the site to perform an operation that the plugin is designed to handle: exporting or restoring an archive. That delay in execution is what makes this defect a second-order SQL injection. The malicious input is stored rather than executed immediately and becomes dangerous only when the plugin retrieves it later during an archive operation.

In detail: the injected SQL can expose the plugin's import secret key (ai1wm_secret_key) via a public comment, allowing the attacker to obtain it and import a malicious '.wpress' archive containing executable code. The initial entry point is WordPress's native trackbacks: the exploit chain begins with the trackback function of WordPress core. An attacker can send two trackbacks to a public post, each containing a trailing backslash and a URL pointing to a payload. The plugin stores these values without removing the backslashes or rejecting the URLs.

The researcher Jack Taylor reported the bug: he reported the flaw to Wordfence through its bug bounty programme on 14 August; Wordfence then notified ServMask, the plugin developer, describing the defect as a second-order SQL injection attack.

Affected versions and fix

The vulnerability affects all versions of All-in-One WP Migration and Backup up to 7.109 and was fixed in version 7.110, released on 20 August. Anyone managing multiple installations can check the active version from the WordPress dashboard under Plugins, or from the command line with WP-CLI:

wp plugin list --name=all-in-one-wp-migration
wp plugin update all-in-one-wp-migration

How many sites remain at risk

The alarming figure is not the severity of the bug itself, but how slowly the fix has been applied. As of 3 September, only 35% of all installations had been updated to version 7.110, meaning approximately 3.2 million sites are running a vulnerable version of the plugin, according to WordPress data.

What to check in logs

Anyone suspecting a previous exploit attempt should search database logs or .wpress exports generated before the update for any public comments containing anomalous SQL strings or references to ai1wm_secret_key, and check received trackbacks for suspicious URLs with trailing backslashes. If the site has already run an export/import cycle with a version prior to 7.110, it is worth regenerating the plugin's secret key and reviewing comments in moderation before approving them.

For those managing shared hosting or multi-site panels, the practical advice remains the same when facing CVSS 8.8 on a plugin with 5 million installations: update first, check afterwards.