As cited
Copy frozen at (site build).
vulnerabilities
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
A second-order SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) was discovered in All-in-One WP Migration and Backup plugin, affecting over 5 million WordPress installations. An unauthenticated attacker can plant malicious SQL through trackback comments that executes when a site administrator exports and imports their site, allowing the attacker to leak the plugin's secret key and achieve remote code execution. The vulnerability was patched in version 7.110 on August 20, 2026, with Wordfence Premium users receiving protection on August 16, 2026, and free users on September 15, 2026.
Why it matters: WordPress site administrators using All-in-One WP Migration and Backup versions 7.109 and earlier must update immediately to 7.110, as unauthenticated attackers can compromise entire sites through this vulnerability during routine backup and restore operations.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
A second-order SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) was discovered in All-in-One WP Migration and Backup plugin, affecting over 5 million WordPress installations. An unauthenticated attacker can plant malicious SQL through trackback comments that executes when a site administrator exports and imports their site, allowing the attacker to leak the plugin's secret key and achieve remote code execution. The vulnerability was patched in version 7.110 on August 20, 2026, with Wordfence Premium users receiving protection on August 16, 2026, and free users on September 15, 2026.
Why it matters: WordPress site administrators using All-in-One WP Migration and Backup versions 7.109 and earlier must update immediately to 7.110, as unauthenticated attackers can compromise entire sites through this vulnerability during routine backup and restore operations.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
An unauthenticated second-order SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) affects the All-in-One WP Migration and Backup WordPress plugin in versions up to 7.109, impacting approximately 5 million active installations. An attacker can plant malicious SQL via trackback comments that executes when a site administrator performs an export and import cycle, allowing extraction of the plugin's secret key and remote code execution leading to complete site compromise. The vendor released patched version 7.110 on August 20, 2026.
Why it matters: WordPress site administrators using All-in-One WP Migration and Backup must update immediately to version 7.110 or later to prevent attackers from compromising their sites through a routine backup and restore operation.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
An unauthenticated second-order SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) affects All-in-One WP Migration and Backup, a WordPress plugin installed on over 5 million sites, in versions up to 7.109. Attackers can plant malicious SQL through trackbacks that executes when administrators perform routine backup restore operations, allowing extraction of the plugin's secret key and remote code execution. The vendor released patched version 7.110 on August 20, 2026, and Wordfence deployed firewall protection for Premium users on August 16, 2026, with free user protection scheduled for September 15, 2026.
Why it matters: WordPress administrators using All-in-One WP Migration and Backup through version 7.109 face complete site takeover if they have not updated to version 7.110, as the vulnerability requires no authentication to exploit.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
An unauthenticated second-order SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) affects the All-in-One WP Migration and Backup WordPress plugin in versions up to 7.109, impacting approximately 5 million installations. An attacker can plant malicious SQL through WordPress trackbacks that executes when a site administrator performs an archive restore, allowing extraction of the plugin's secret key and achieving remote code execution. The vendor released patched version 7.110 on August 20, 2026, and Wordfence deployed firewall protection for premium users on August 16, 2026, with free users receiving protection on September 15, 2026.
Why it matters: WordPress site administrators using All-in-One WP Migration and Backup through version 7.109 must update immediately to version 7.110 to prevent unauthenticated attackers from taking over their sites during routine backup and restore operations.
- Source published
- First seen by Cybersecurity Tracker