CVE-2026-19949: Unauthenticated SQL Injection in All‑in‑One WP Migration—Update to 7.110

A widely used WordPress backup and migration plugin has received a high‑severity fix. According to a disclosure from Wordfence, All‑in‑One WP Migration and Backup (5M+ active installs) contained an unauthenticated, second‑order SQL injection vulnerability tracked as CVE‑2026‑19949. The issue is addressed in version 7.110, and users are urged to update.

Why it matters: backup and migration tools process database imports by design. If input parsing goes wrong, stored content can be transformed into executable SQL during restore. At scale, that’s risky—especially when the plugin is as popular as All‑in‑One WP Migration.

What Wordfence reported

Wordfence describes a second‑order SQL injection that is planted first and only executed later during an archive restore. In this case, an attacker can submit specially crafted trackbacks to a public post. The data sits harmlessly in the database until a site administrator exports and then imports the site with the plugin. During import, the plugin rewrites values inside SQL statements. A flaw in how string boundaries were identified could cause attacker‑controlled content to escape a string literal and become executable SQL.

Wordfence states this can be used to read the plugin’s secret key from the database and then drive the plugin’s import functionality using that key. With a crafted archive, this could lead to remote code execution during restore. Wordfence rates the issue 8.8 (High) and reports it affects All‑in‑One WP Migration and Backup versions up to 7.109, with a fix in 7.110.

It’s also notable that, per Wordfence, the attack requires an administrator to perform a backup/restore cycle after the malicious content is planted. The initial planting step does not require authentication, but the payload only becomes dangerous during a subsequent import.

Wordfence’s post also outlines a disclosure and protection timeline for its users and credits the original reporter. This article relies on Wordfence’s public write‑up for these details.

Practical next steps

Based on the available evidence, the immediate action is straightforward:

• If you use All‑in‑One WP Migration and Backup, confirm your site is running version 7.110 or later. Wordfence reports that versions up to and including 7.109 are vulnerable.
• If you rely on a web application firewall, review your vendor’s advisories for any temporary rules related to CVE‑2026‑19949. Wordfence states it shipped a firewall rule for this issue to its customers on a staged schedule.

Other recent WordPress SQL injections to review

Patchstack’s vulnerability database lists several additional SQL injection advisories in popular plugins. If you run any of these, check versions and update accordingly:

• CVE‑2026‑81287 — Charitable: update to 1.8.12.2 or later (source: Patchstack). Advisory
• CVE‑2026‑81293 — WP Data Access: update to 5.5.82 or later (source: Patchstack). Advisory
• CVE‑2026‑81756 — Smart Marketing SMS and Newsletters Forms: update to 5.1.25 or later (source: Patchstack). Advisory
• CVE‑2026‑81763 — Throws SPAM Away: update to 3.9 or later (source: Patchstack). Advisory

Details on exploitation in the wild were not provided in the evidence for these entries; treat them as important maintenance updates.

Keep it in perspective

The All‑in‑One WP Migration issue illustrates how “second‑order” flaws can surface only during backup and restore workflows. The fix exists, and the trigger requires an administrator to run an import. Still, the combination of unauthenticated planting and a high‑install‑base plugin means the safest path is prompt patching and routine plugin hygiene.

For full technical context and the vendor’s suggested actions, see Wordfence’s write‑up: 5 Million WordPress Sites Affected by SQL Injection Vulnerability in All‑in‑One WP Migration and Backup WordPress Plugin.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.