All-in-One WP Migration and Backup WordPress Plugin Fixes Flaw That Could Enable Site Takeover
The All-in-One WP Migration and Backup WordPress plugin has fixed the CVE-2026-19949 vulnerability. Operators should update to version 7.110 or later.
The CVE-2026-19949 vulnerability in the All-in-One WP Migration and Backup plugin could, in a specific multistage attack, lead to remote code execution on a WordPress site. The flaw affects versions 7.109 and earlier, while a fix is available in version 7.110.
Wordfence classifies the flaw as an unauthenticated second-order SQL injection vulnerability with a severity rating of 8.8. According to WordPress.org, the All-in-One WP Migration and Backup plugin has more than five million active installations. WordPress.org is already distributing the fixed version 7.110.
How CVE-2026-19949 Works in All-in-One WP Migration
The exploitation scenario is not immediate. In the described scenario, an attacker could prepare an archive containing malicious data. It would only be executed later, when an administrator restores the archive through the plugin. The flaw’s classification as unauthenticated should therefore be understood in this context: executing the malicious SQL itself requires a subsequent administrative action during backup restoration.
According to Wordfence, successful exploitation could allow an attacker to obtain the value of ai1wm_secret_key. The attacker could then achieve remote code execution, potentially taking over the compromised site.
The Fix for CVE-2026-19949 Is in Version 7.110
Operators of WordPress sites using All-in-One WP Migration and Backup should check the installed version and promptly upgrade to version 7.110 or later. The risk affects active installations running version 7.109 and earlier.
- open the Plugins section in the WordPress administration panel,
- check the version of All-in-One WP Migration and Backup,
- install update 7.110 or later,
- use only archives from a trusted source when restoring backups.
Particular attention should be paid to archives obtained outside the organization’s own controlled backup process. Restoring an archive by an administrator is the step required to activate the described attack.
No Confirmed Active Exploitation
The available information contains no confirmed evidence that CVE-2026-19949 is being actively exploited in the wild. Secondary sources cite estimates of the number of unpatched sites, but this is not an independently verified figure and is based on an assumed update rate.
Further developments will depend primarily on whether Wordfence, ServMask, or WordPress.org publish information about exploitation and whether additional recommendations emerge for administrators who cannot apply the update immediately.
Sources
- Wordfence Threat Intelligence – Record of CVE-2026-19949, affected versions up to 7.109, severity rating of 8.8, and the fix in version 7.110.
- WordPress.org – Currently distributed version 7.110 and more than 5 million active installations.
- BleepingComputer – Description of the multistage exploitation scenario, the fix date, and an estimate of the number of unpatched installations.
Verified and updated: 09/03/2026 13:32
