Over 3 Million WordPress Sites Exposed by Migration Plugin SQL Injection Flaw

3.2 Million Sites, One Trackback Away From Compromise

A high-severity second-order SQL injection vulnerability, tracked as CVE-2026-19949 and scored CVSS 8.8, has been disclosed in All-in-One WP Migration and Backup, a WordPress plugin installed on more than 3 million sites. Discovered by WordPress security firm Defiant, the flaw can be chained into remote code execution during a routine site restore.

Vulnerability Summary

How the Attack Works

The bug exists because user-supplied input is insufficiently escaped and existing SQL queries are not sufficiently prepared during the plugin's archive restore process. The exploit chain does not require direct access to the restore feature itself:

1. Attacker submits two crafted trackbacks to the target site, containing
   trailing backslashes and payload URLs
2. The trackback content is stored, unescaped, in public site comments
3. A site administrator later archives the site and imports it via
   All-in-One WP Migration
4. During restore, the plugin rewrites URLs and table prefixes, and the
   attacker's stored input is interpreted as executable SQL
5. The plugin's secret restore key is exposed through the manipulated query
6. The attacker uses the exposed key to deploy a malicious must-use plugin,
   achieving remote code execution

The attack is notable for turning a routine administrative action — restoring a backup — into the trigger for exploitation, without the attacker needing any direct interaction with the migration interface.

Patch Adoption Is Lagging

Despite a fix shipping on August 20, 2026, adoption has been slow: as of September 3, only about 35% of installations had updated to version 7.110 or later. That leaves an estimated 2 million-plus sites still running vulnerable code more than two weeks after the patch became available.

Recommended Actions

1. Update to version 7.110 or later immediately via the WordPress plugin dashboard or WP-CLI (wp plugin update all-in-one-wp-migration)
2. Audit recent comments and trackbacks for suspicious payloads containing backslashes or unusual URL patterns
3. Review must-use plugins (wp-content/mu-plugins/) for unauthorized additions
4. Rotate the migration secret key and WordPress security salts after updating
5. Disable trackbacks/pingbacks site-wide if they aren't in active use, to close off the initial injection vector

Sources

• SecurityWeek — Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

Related Reading

• CVE-2026-4357: Maximum-Severity File Upload Flaw in Embed HTML5 Game Plugin
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+