A Backup Feature Turned Into a Delayed-Fuse Attack
A newly disclosed SQL injection vulnerability in All-in-One WP Migration and Backup, a ServMask plugin with more than 5 million active installs, could let an unauthenticated attacker eventually take full control of an affected WordPress site — but only after an administrator performs a routine, unrelated action: restoring a backup.
Tracked as CVE-2026-19949, the flaw is a second-order (stored) SQL injection (CWE-89) rated CVSS 8.8 (High), caused by incorrect parsing and escaping of backslashes and quotation marks when the plugin rewrites database content during a restore operation.
How the Attack Works
The exploit chain doesn't fire immediately — it's staged:
- An unauthenticated attacker plants a malicious payload using WordPress trackbacks, a routine, unauthenticated comment-like mechanism built into WordPress itself.
- The payload sits dormant in the database until a site administrator exports or restores a backup archive through the plugin — an entirely normal, expected use of the tool.
- That restore operation processes the planted data, triggering the SQL injection through mishandled string boundaries.
- The injected SQL can leak the plugin's secret import key (
ai1wm_secret_key) by exposing it in a public comment. - With that key in hand, the attacker imports a malicious
.wpressarchive of their own — one containing executable code — achieving remote code execution and full site takeover.
Because the trigger is a legitimate backup/restore action rather than anything unusual, the attack can sit unnoticed for an extended period before it's set off.
Affected Versions and Patch Timeline
| Product | Affected Versions | Fixed Version |
|---|---|---|
| All-in-One WP Migration and Backup | ≤ 7.109 | 7.110 |
- August 15, 2026 — Security researcher Jack Taylor reports the flaw to Wordfence.
- August 20, 2026 — ServMask ships the fix in version 7.110, a five-day turnaround from disclosure.
As of publication, only around 35% of the plugin's install base had updated to a patched version — leaving an estimated 3.25 million sites still running vulnerable code.
There is no confirmed evidence of in-the-wild exploitation at this time, and the flaw is not yet listed in CISA's Known Exploited Vulnerabilities catalog. Given the size of the install base and the plugin's status as one of the most widely used WordPress backup tools, that is likely to change quickly once a working proof-of-concept circulates.
Why It Matters
The delayed, second-order nature of this bug makes it easy to underestimate: there's no obvious "attack in progress" moment, since the trigger is an admin's own backup/restore workflow. Site owners running All-in-One WP Migration and Backup should update to 7.110 or later immediately, and review recent comment/trackback activity for suspicious payloads planted before the patch was applied.