CVE-2026-19949 is a high-severity (CVSS 8.8) SQL injection vulnerability in All-in-One WP Migration and Backup, a plugin active on more than 3 million WordPress sites. It affects every version up to and including 7.109, was patched in 7.110 on August 20, 2026 — and as of early September, only about 35% of installations had actually updated. If this plugin is on your site, this is worth checking today, not eventually.
Why This One Is Sneaky: It’s a Second-Order Injection
Most SQL injection vulnerabilities are exploited in a single request. This one is different: it’s a second-order injection. An attacker first stores malicious input somewhere in the WordPress database through a normal-looking interaction, then waits for the site to perform an operation the plugin was designed for — exporting or restoring an archive. The vulnerability lives in that archive restore functionality, where user-supplied input is insufficiently escaped and the underlying SQL query lacks proper preparation. That delay between planting the payload and triggering it is exactly what makes second-order injections easy to miss in a quick security scan.
Who’s Affected
| Version | Status |
|---|---|
| 7.109 and earlier | Vulnerable — update immediately |
| 7.110 or later | Patched |
Given how widely this plugin is installed — often set up once during a migration and then forgotten — it’s worth specifically checking for it even on sites where you don’t remember actively using it.
What to Do
- Check whether All-in-One WP Migration and Backup is installed, active or not — an inactive copy on disk isn’t exploitable through this vector, but confirm status either way.
- Update to 7.110 or later immediately if it’s active.
- If you can’t update right away, deactivate the plugin rather than leaving a known-vulnerable version active.
- Review recent database activity for anything unusual if the plugin has been active and unpatched for a while — a second-order injection means the exploit attempt could have happened well before any restore/export operation actually ran it.
If You Find Signs of Compromise
Unexpected admin accounts, unfamiliar database rows, or content changes you didn’t make are signs of exploitation, not just exposure. We cover the actual recovery process in WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. If you’d like a site checked directly, get in touch.
Frequently Asked Questions
What makes a second-order SQL injection different from a normal one?
A normal injection is exploited in one request. A second-order injection stores the malicious payload first, then relies on a separate, later operation — here, an archive restore or export — to actually execute it, which can make the attack harder to spot with a quick scan.
Do I need to update if the plugin is deactivated?
An inactive plugin isn’t running its code, so the immediate exploit path isn’t live. Still, either update it or remove it entirely rather than leaving a known-vulnerable version sitting on the server.
Is updating enough, or should I check for prior compromise too?
Updating closes the vulnerability going forward. Given the second-order nature of this bug, if the plugin was active and unpatched for any length of time, it’s worth a quick look for unfamiliar admin accounts or unexpected database changes as a precaution.
Featured image: original illustration.