CVE-2026-19949: All-in-One WP Migration Affects 5M+ Installations

Short answer: CVE-2026-19949 is a second-order SQL injection in All-in-One WP Migration and Backup with a CVSS score of 8.8 (High). Versions 7.109 and earlier are affected; 7.110 contains the fix. The plugin has more than 5 million active installations, but that does not mean five million sites were compromised.

Facts checked on September 2, 2026. The public research describes a conditional chain: an attacker plants data through trackbacks, and the payload is reached later when an administrator exports and then imports or restores the site.

The real scope, in numbers

Wordfence received the report on August 14, notified the vendor on August 15, received acknowledgment on August 17, and version 7.110 shipped on August 20. The official changelog summarizes the fix as handling find-and-replace values ending in a backslash. Full technical research was published September 1.

Why this is “second-order” SQL injection

In a classic SQLi, malicious input reaches a vulnerable query immediately. Here the input is stored first and becomes dangerous in a later operation:

1. The attacker finds a public post with pings enabled.
2. Two unauthenticated trackbacks plant a trailing-backslash value and manipulated URL.
3. WordPress stores the data.
4. An administrator later exports and then imports or restores the archive with an affected plugin version.
5. The stored value reaches the vulnerable replacement query.
6. The attacker may extract ai1wm_secret_key, authenticate to the import path, and load a crafted .wpress archive containing a malicious MU plugin.

The chain can escalate from SQL injection to code execution as the web-server user and full WordPress takeover. The sequence matters: this is not an instant compromise of every installation. It depends on the vulnerable version, public ping-enabled content, planting, and a later export/restore.

Check whether your installation is affected

In WordPress, open Plugins → Installed Plugins. With WP-CLI:

wp plugin get all-in-one-wp-migration --fields=name,status,version,update

If it reports 7.109 or lower, update. If the plugin is inactive now but was active during the exposure window, review backup and restore history as well.

How to fix CVE-2026-19949

wp plugin update all-in-one-wp-migration
wp plugin get all-in-one-wp-migration --field=version

The result should be 7.110 or later. Create a recoverable off-server backup first and verify restoration. Disabling trackbacks reduces one prerequisite but does not replace the patch or remove stored data.

Exposure triage: follow the sequence

wp post list --post_type=post --post_status=publish --ping_status=open --fields=ID,post_title,ping_status --format=table
wp comment list --type=trackback --fields=comment_ID,comment_post_ID,comment_author_url,comment_date_gmt --format=table
wp comment list --type=pingback --fields=comment_ID,comment_post_ID,comment_author_url,comment_date_gmt --format=table

find wp-content/mu-plugins wp-content/uploads -type f -name '*.php' -newermt '2026-08-14' -ls
wp core verify-checksums
wp plugin verify-checksums --all

These are generic triage checks; the disclosure does not publish a specific IOC list. Clean output does not prove exploitation never occurred, and legitimate custom files can trigger findings.

If the chain may have completed

1. Preserve logs, the .wpress archive, export/import timestamps, and suspicious comments.
2. Contain the site or restrict administrative traffic.
3. Review administrators, MU plugins, scheduled tasks, web shells, and database changes.
4. Rotate WordPress salts, passwords, API keys, database credentials, and SFTP access after containment.
5. If integrity cannot be established, rebuild from clean core and plugins and restore only verified content.

Does turning off pingbacks fix it?

No. It is defense in depth. Disable new link notifications under Settings → Discussion if unused and review existing posts, but the primary fix remains version 7.110 or later.

A fair risk assessment

The issue should not be minimized: five million active installations and a path to code execution justify urgent action. It should not be exaggerated either: the research does not claim five million compromises or confirmed mass exploitation. CVE-2026-19949 was absent from the CISA KEV snapshot checked September 2; KEV absence is not proof of no exploitation.

For another widely deployed plugin case, see our Gravity Forms CVE-2026-19513 analysis. The operational pattern is the same: accurate inventory, verifiable updates, and evidence before declaring a site clean.

FAQ

Which All-in-One WP Migration version is fixed?

The fix shipped in 7.110. Use that release or a later compatible version and verify after updating.

Does an attacker need a WordPress account?

The described trackback planting stage is unauthenticated, but execution depends on an administrator later performing a vulnerable export and import/restore.

Were five million sites hacked?

No public evidence supports that claim. Five million is the active-installation footprint potentially affected by version, not a confirmed-compromise count.

Primary sources: Wordfence research and the WordPress.org plugin page and changelog.