One of the most widely used WordPress plugins in the world has a serious security hole. All-in-One WP Migration and Backup, which millions of site owners use to move and back up their websites, contains a vulnerability that allows remote code execution. According to security firm Defiant, more than 3 million sites are affected, and as of September 3 roughly 3.2 million installations were still unpatched.
What happened
The flaw is tracked as CVE-2026-19949 and scores 8.8 out of 10 for severity. It affects all versions up to and including 7.109. The fix shipped on August 20, 2026 in version 7.110, yet a large share of sites still haven’t installed it. That gap is the classic WordPress problem: a patch exists, but attackers know many sites won’t apply it for weeks.
How the attack works
This is a second-order SQL injection. The attacker’s input isn’t exploited immediately; it is stored in the database and only becomes dangerous later, when the plugin reuses it inside a query. Here, an attacker submits a malicious trackback or comment to a public post containing URLs with trailing backslashes. In the database it looks harmless.
The trap springs when a site administrator runs an archive and restore, exactly the job the plugin is installed for. During a restore the plugin rewrites URLs in the content, and because input isn’t escaped properly, the stored text turns into an executable SQL statement. It can leak the secret restore key, and the attacker can then upload a webshell or a malicious must-use plugin. The outcome is full site takeover.
What has to be true for the attack to work
- the attacker can submit a comment or trackback (unauthenticated access to the comments REST API), and
- an administrator later performs an archive and restore.
The second condition softens the risk a little; this isn’t a one-click infection. But plenty of sites migrate regularly, for example when changing hosts, building a staging copy or recovering from a problem. And automated scanners can plant malicious comments in bulk and simply wait.
What to do right now
- Update the plugin to version 7.110 or newer. It’s the only real fix.
- Review your comments and trackbacks. Delete suspicious entries with odd URLs and trailing backslashes, especially if you restored a site after August 20 without updating first.
- Turn off trackbacks if you don’t use them. Most sites gain nothing from them, and they only open another attack path.
- Check the site for signs of compromise: unknown files in the mu-plugins folder, new administrator accounts, foreign code in theme files.
- Don’t leave the plugin active when you don’t need it. Migration and backup tools belong on a site only while they’re in use.
Why this matters for every website
The story keeps repeating: a critical bug, a patch released weeks ago and millions of sites still running the vulnerable version. In recent weeks we’ve covered flaws in Elementor Pro, Everest Forms and Forminator. The common denominator is always the same: what matters isn’t whether you know about the bug, but how fast you patch it.
Manual updates once a month are no longer enough. Automatic security updates, vulnerability monitoring and regular off-site backups are the basic toolkit of any professionally managed website. And a backup created by the very plugin that is vulnerable is no safety net, so store copies elsewhere too.
Conclusion
If you use All-in-One WP Migration, update today and check your site. Don’t want to deal with it yourself? At Full-Net Servis we take care of WordPress maintenance, updates and security. Get in touch and ask for a free website check.
