CVE-2026-19949 is a second-order SQL injection in All-in-One WP Migration and Backup, versions through 7.109. Wordfence credits researcher Jack Taylor with the discovery and disclosed the flaw to ServMask on August 15, 2026.
An attacker needs no authentication to plant the payload, but it only executes when an administrator restores a backup.
A successful attack can expose the plugin’s secret import key and allow attackers to import a malicious .wpress archive containing executable code.
ServMask patched the flaw in version 7.110 on August 20, 2026. Roughly 3.25 million sites remained vulnerable as of BleepingComputer’s report. Public reporting does not confirm active exploitation of CVE-2026-19949.
A newly disclosed flaw in All-in-One WP Migration and Backup shows how a routine site restore can quietly hand attackers control of a WordPress site. Wordfence identified the issue, tracked as CVE-2026-19949, as a second-order SQL injection in a plugin that more than five million sites use for backup and restore.
BleepingComputer reported that an unauthenticated attacker can plant malicious input through WordPress trackbacks long before exploitation occurs. The injected data stays dormant until an admin restores a backup archive, at which point it executes as SQL.
CVE-2026-19949 turns a core administrative task into an unpredictable attack trigger for enterprise site owners. This WordPress backup plugin vulnerability affects the plugin’s broad install base of over five million sites. Security teams should treat backup and restore as part of the attack surface, not just a recovery tool.
A trackback comment as the entry point
Wordfence’s report explains that CVE-2026-19949 stems from how the plugin parses escaped backslashes and quotation marks. This happens while the plugin rewrites database content during archive restoration.
An attacker does not need any credentials to submit the initial payload through the trackback. They can submit crafted data to a WordPress site through its trackback feature, a legacy commenting mechanism built into WordPress.
That crafted data sits inactive in the database. It only becomes dangerous once triggered by a separate, unrelated action, which is what makes this a second-order SQL injection.
No authentication required to submit the initial payload
Entry point: WordPress trackbacks
Payload stays dormant in the database until triggered
Classified as second-order SQL injection because the trigger is a separate, later action
Cybersecurity essentials for any organization
Cybersecurity essentials guide: core practices organizations need to reduce risk.
Why the restore step is the real trigger
The stored payload activates when an administrator restores, or imports, a backup archive. Wordfence notes that backup and restore are the plugin’s core purpose, so this step happens regularly on active sites.
Once triggered, the injected SQL can expose the plugin’s secret import key, called ai1wm_secret_key, through a public comment. An attacker who obtains this key can import a malicious .wpress archive.
That archive can contain executable code. Wordfence states that code execution at this level can lead to complete control of the affected website, making this a genuine WordPress site takeover path.
Wordfence also notes that deactivating a vulnerable plugin version lowers risk but does not eliminate it. Reactivating the plugin, even briefly, can still expose a site to exploitation.
Trigger: an administrator restoring (importing) a backup archive
Exposes the plugin’s secret import key (ai1wm_secret_key) via a public comment
Stolen key enables import of a malicious .wpress archive with executable code
Can result in full site takeover
Deactivation lowers but does not eliminate risk
Patch status across five million sites
All-in-One WP Migration and Backup has more than five million active installations, per WordPress.org data cited by BleepingComputer. ServMask released the fix, version 7.110, on August 20, 2026, five days after Wordfence’s private disclosure.
Only about 35 percent of users had updated by BleepingComputer’s report, leaving roughly 3.25 million sites vulnerable. This gap matters for WordPress patch management programs expecting quick plugin updates. A slow update cycle keeps CVE-2026-19949 exploitable long past the fix date.
Active installations: 5 million+
Disclosure to vendor: August 15, 2026
Patch released (version 7.110): August 20, 2026
Sites updated by BleepingComputer’s report: ~35 percent
Investigates suspicious endpoint activity, currently supported on Windows and macOS environments.
Classifies detected threats against the MITRE ATT&CK framework and lets analysts isolate the device or quarantine the malicious file.
What Hexnode does not do: detect CVE-2026-19949 itself, patch the plugin, or monitor WordPress application logs. It complements, not replaces, the vendor patch and site-level investigation this flaw requires.
Featured resource
Building a cybersecurity framework for your enterprise
Cybersecurity frameworks explained: types, benefits, and how UEM strengthens your organization's overall security posture today.
Confirm the affected WordPress installation runs All-in-One WP Migration and Backup version 7.110 or later.
Review trackback and comment logs for suspicious payloads submitted before the update.
Check for unfamiliar .wpress import activity or unexpected admin accounts created after a restore.
Verify that administrator endpoints run current security updates too. Server patching and endpoint patching are not the same control.
Rotate the plugin’s secret import key if any exposure is suspected.
FAQs
Does disabling the plugin remove the risk from CVE-2026-19949?
Wordfence notes that a deactivated vulnerable version carries less risk, but reactivating it, even temporarily, can still trigger the stored payload.
Is updating to version 7.110 enough to fully secure a site?
The update addresses CVE-2026-19949 itself. Sites should also check for signs of prior exploitation before treating the incident as closed.
How would a team know if CVE-2026-19949 was already exploited before patching
Look for unexpected .wpress imports, new admin accounts, or unfamiliar executable files tied to backup and restore activity, then investigate further.
Conclusion
CVE-2026-19949 shows that a routine backup restore can become a delayed WordPress site takeover trigger. The flaw’s second-order design means the danger surfaces well after the initial exploitation attempt.
Security teams should prioritize patching to version 7.110, auditing for prior compromise, and treating WordPress administrator security as connected to endpoint and identity controls, not a separate concern.
Stay ahead of the next WordPress plugin flaw.
Start your free trial and see enterprise security intelligence in action.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
