CVE-2026-19949

The All-in-One WP Migration and Backup plugin for WordPress (all versions up to and including 7.109) contains an SQL injection flaw (CWE-89) in its archive restore functionality, caused by insufficient escaping of user-supplied parameters and failure to properly prepare existing SQL queries. An unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the site database. Attackers can leverage this to obtain the ai1wm_secret_key when a site administrator performs an archive restore, which can then be escalated to remote code execution. Any WordPress site running the plugin at version 7.109 or earlier is affected. Two public proofs of concept exist on GitHub, but there is no confirmed in-the-wild exploitation yet (EPSS 0.5%, not in CISA KEV), so defenders should treat this as a likely near-term target given the plugin's install base.

What to do: Update All-in-One WP Migration and Backup to the latest patched release (any version after 7.109) as soon as possible. Until patched, avoid performing archive restores, especially from untrusted archives, and verify the site's ai1wm_secret_key has not been exposed (rotate it if unsure), since its disclosure enables the RCE chain. Review logs for unexpected SQL errors or queries against the restore endpoint and check whether the plugin is active on internet-facing sites.