Short answer: CVE-2026-19949 is a second-order SQL injection in All-in-One WP Migration and Backup with a CVSS score of 8.8 (High). Versions 7.109 and earlier are affected; 7.110 contains the fix. The plugin has more than 5 million active installations, but that does not mean five million sites were compromised.
Facts checked on September 2, 2026. The public research describes a conditional chain: an attacker plants data through trackbacks, and the payload is reached later when an administrator exports and then imports or restores the site.
The real scope, in numbers
| Metric | Verified value | Meaning |
|---|---|---|
| Active installations | More than 5 million | Potential plugin footprint, not confirmed victims |
| Severity | CVSS 8.8 / High | Serious impact with attack conditions |
| Affected versions | ≤ 7.109 | Must be updated |
| Fixed version | 7.110 | Released August 20, 2026 |
| Research bounty | US$5,761 | Wordfence program figure |
| Compromised sites | Not published | No verifiable public count |
Wordfence received the report on August 14, notified the vendor on August 15, received acknowledgment on August 17, and version 7.110 shipped on August 20. The official changelog summarizes the fix as handling find-and-replace values ending in a backslash. Full technical research was published September 1.
Why this is “second-order” SQL injection
In a classic SQLi, malicious input reaches a vulnerable query immediately. Here the input is stored first and becomes dangerous in a later operation:
- The attacker finds a public post with pings enabled.
- Two unauthenticated trackbacks plant a trailing-backslash value and manipulated URL.
- WordPress stores the data.
- An administrator later exports and then imports or restores the archive with an affected plugin version.
- The stored value reaches the vulnerable replacement query.
- The attacker may extract
ai1wm_secret_key, authenticate to the import path, and load a crafted.wpressarchive containing a malicious MU plugin.
The chain can escalate from SQL injection to code execution as the web-server user and full WordPress takeover. The sequence matters: this is not an instant compromise of every installation. It depends on the vulnerable version, public ping-enabled content, planting, and a later export/restore.
Check whether your installation is affected
In WordPress, open Plugins → Installed Plugins. With WP-CLI:
wp plugin get all-in-one-wp-migration --fields=name,status,version,update
If it reports 7.109 or lower, update. If the plugin is inactive now but was active during the exposure window, review backup and restore history as well.
How to fix CVE-2026-19949
wp plugin update all-in-one-wp-migration
wp plugin get all-in-one-wp-migration --field=version
Protect WordPress with a solid hosting foundation
Host your sites with backups, SSL, and support for keeping WordPress and its plugins up to date.
The result should be 7.110 or later. Create a recoverable off-server backup first and verify restoration. Disabling trackbacks reduces one prerequisite but does not replace the patch or remove stored data.
Exposure triage: follow the sequence
| Question | If “yes” |
|---|---|
| Was All-in-One WP Migration ≤7.109 active? | The vulnerable-version condition existed |
| Were public posts open to pings? | An unauthenticated planting path existed |
| Were unusual pingbacks or trackbacks received? | Review stored URLs, dates, and content |
| Did an admin export and later import/restore? | Stored input may have reached the second stage |
| Did new MU plugins or PHP files appear? | Treat as a potential incident |
wp post list --post_type=post --post_status=publish --ping_status=open --fields=ID,post_title,ping_status --format=table
wp comment list --type=trackback --fields=comment_ID,comment_post_ID,comment_author_url,comment_date_gmt --format=table
wp comment list --type=pingback --fields=comment_ID,comment_post_ID,comment_author_url,comment_date_gmt --format=table
find wp-content/mu-plugins wp-content/uploads -type f -name '*.php' -newermt '2026-08-14' -ls
wp core verify-checksums
wp plugin verify-checksums --all
These are generic triage checks; the disclosure does not publish a specific IOC list. Clean output does not prove exploitation never occurred, and legitimate custom files can trigger findings.
If the chain may have completed
- Preserve logs, the
.wpressarchive, export/import timestamps, and suspicious comments. - Contain the site or restrict administrative traffic.
- Review administrators, MU plugins, scheduled tasks, web shells, and database changes.
- Rotate WordPress salts, passwords, API keys, database credentials, and SFTP access after containment.
- If integrity cannot be established, rebuild from clean core and plugins and restore only verified content.
Does turning off pingbacks fix it?
No. It is defense in depth. Disable new link notifications under Settings → Discussion if unused and review existing posts, but the primary fix remains version 7.110 or later.
A fair risk assessment
The issue should not be minimized: five million active installations and a path to code execution justify urgent action. It should not be exaggerated either: the research does not claim five million compromises or confirmed mass exploitation. CVE-2026-19949 was absent from the CISA KEV snapshot checked September 2; KEV absence is not proof of no exploitation.
For another widely deployed plugin case, see our Gravity Forms CVE-2026-19513 analysis. The operational pattern is the same: accurate inventory, verifiable updates, and evidence before declaring a site clean.
FAQ
Which All-in-One WP Migration version is fixed?
The fix shipped in 7.110. Use that release or a later compatible version and verify after updating.
Does an attacker need a WordPress account?
The described trackback planting stage is unauthenticated, but execution depends on an administrator later performing a vulnerable export and import/restore.
Were five million sites hacked?
No public evidence supports that claim. Five million is the active-installation footprint potentially affected by version, not a confirmed-compromise count.
Primary sources: Wordfence research and the WordPress.org plugin page and changelog.
