What Changed
BleepingComputer reports that CVE-2026-19949 affects All-in-One WP Migration and Backup through version 7.109. Wordfence describes it as a second-order SQL injection bug caused by incorrect parsing of escaped backslashes and quotation marks while the plugin rewrites database content during archive restoration.
The exploit path is more specific than a generic 'RCE in WordPress' headline suggests. An unauthenticated attacker can plant crafted data through WordPress trackbacks, wait for an administrator to export and import the site, then use the resulting SQL execution to expose the plugin's secret import key and upload a malicious .wpress archive.
Why This Matters Operationally
The important operational point is that the triggering action is routine for the plugin's core purpose. The payload may sit dormant until an admin runs a restore or migration task, which means some teams may underestimate the risk because exploitation is not always immediate or noisy.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Scale matters too. BleepingComputer says the plugin has more than five million active installations, while Wordfence estimates only about 35% of the user base has updated to the fixed release, leaving roughly 3.25 million sites on vulnerable versions.
What Defenders Should Verify First
- Identify every WordPress site running All-in-One WP Migration and Backup and confirm whether any are still on version 7.109 or earlier instead of the fixed 7.110 release.
- Review whether trackbacks are enabled or otherwise reachable, and whether the site regularly performs imports or restorations that could trigger dormant malicious data.
- Inspect administrator activity, plugin changes, scheduled tasks, and unexpected content or user creation for signs the secret import key may have been exposed and used.
- Treat temporarily deactivated vulnerable copies as still relevant if admins commonly re-enable the plugin for occasional migrations or restores.
Source Context
CyberExperts used BleepingComputer's reporting and the Wordfence technical explanation it cites to preserve the key details readers need first: CVE-2026-19949, the second-order SQL injection mechanism, the import-key exposure step, the fixed version 7.110, and the large still-unpatched install base.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Tuesday’s brief: GitLab’s critical fix, then Patch Tuesday, hijacked fridge controllers and Server 2012’s last update
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
