As cited
Copy frozen at (site build).
vulnerabilities
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
A second-order SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) was discovered in All-in-One WP Migration and Backup plugin, affecting over 5 million WordPress installations. An unauthenticated attacker can plant malicious SQL through trackback comments that executes when a site administrator exports and imports their site, allowing the attacker to leak the plugin's secret key and achieve remote code execution. The vulnerability was patched in version 7.110 on August 20, 2026, with Wordfence Premium users receiving protection on August 16, 2026, and free users on September 15, 2026.
Why it matters: WordPress site administrators using All-in-One WP Migration and Backup versions 7.109 and earlier must update immediately to 7.110, as unauthenticated attackers can compromise entire sites through this vulnerability during routine backup and restore operations.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
A second-order SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) was discovered in All-in-One WP Migration and Backup plugin, affecting over 5 million WordPress installations. An unauthenticated attacker can plant malicious SQL through trackback comments that executes when a site administrator exports and imports their site, allowing the attacker to leak the plugin's secret key and achieve remote code execution. The vulnerability was patched in version 7.110 on August 20, 2026, with Wordfence Premium users receiving protection on August 16, 2026, and free users on September 15, 2026.
Why it matters: WordPress site administrators using All-in-One WP Migration and Backup versions 7.109 and earlier must update immediately to 7.110, as unauthenticated attackers can compromise entire sites through this vulnerability during routine backup and restore operations.
- Source published
- First seen by Cybersecurity Tracker