WordPress Backup Plugin Flaw Turns Routine Backup Into Full Site Takeover

If you run a WordPress site and have the All-in-One WP Migration and Backup plugin installed, an attacker may already have planted the payload that takes over your site — and your next routine backup is what detonates it. Wordfence’s disclosure confirms the attacker plants payload r performs a standard export or import operation

Security firm Wordfence publicly disclosed CVE-2026-19949 on September 2, 2026, following the release of a patch on August 20. The flaw affects all versions through 7.109 and carries a CVSS score of 8.8. As of September 3, approximately 35 percent of the plugin’s user base has updated to the patched version 7.110 — leaving roughly 3.25 million sites still vulnerable

The All-in-One WP Migration and Backup plugin, developed by ServMask Inc., has more than five million active installations across the WordPress ecosystem. It is one of the most widely used tools in WordPress administration, deployed by site owners to export, import, back up, and migrate entire sites — complete databases, themes, media files, and plugins — across servers and hosting providers

Update to version 7.110 immediately Update). Every additional day without the update is a day an attacker can plant a payload through your site’s public trackback endpoint, then wait for you to run a backup

What Makes CVE-2026-19949 Different: Backup Day Is Attack Day

CVE-2026-19949 is a second-order SQL injection class of vulnerability — also called stored SQL injection — specifically engineered to evade the defenses that catch ordinary SQL injection

In a conventional SQL injection attack, a malicious payload executes the moment it enters the application. Signature-based firewalls, web application firewalls, and real-time request filters can catch these because the dangerous SQL is visible at the point of input. Second-order injection breaks that model entirely: the payload is submitted as benign-looking data, stored then reprocessed as SQL in the database without triggering any alert, and only becomes dangerous later — when a separate part of the application retrieves and reprocesses that stored data in a different code context. At the moment of storage, there is nothing to detect.

In this case, the detonation context is the plugin’s own core function. When All-in-One WP Migration rewrites URLs and database table prefixes during a backup export or archive import operation, it handles queries built by string concatenation — assembling query text by directly inserting stored values rather than using parameterized statements, which would separate query structure from user-supplied data. When the rewrite routine encounters the attacker’s stored trackback data, the backslash and quotation mark boundary breaking causes that data to be promoted from stored text to executable SQL. Every site owner running the plugin will, at some point, perform a backup — that is the plugin’s stated purpose. Wordfence notes directly that the Wordfence technical security disclosure identifies the backup trigger as the key vulnerability mechanism: because backup and restore is the plugin’s core purpose, it is a routine action — and the injected SQL will not execute until it takes place.

The vulnerable import controller files at the root of the problem are class-ai1wm-import-controller.php, class-ai1wm-import-database.php, and the vendored class-ai1wm-database.php helper library

How Attackers Use a Dead Protocol as the Entry Point

The attack begins at a WordPress endpoint that most site owners have never thought about: the trackback receiver

Trackbacks are a legacy inter-blog notification mechanism introduced in early WordPress versions to allow one site to notify another that it had linked to it. By 2015, the feature had been eclipsed by social media sharing and was widely described by WordPress security professionals as essentially a spam delivery system. As of 2026, experts uniformly recommend trackbacks obsolete by 2026, characterizing the live feature as a channel maintained almost entirely for backward compatibility that generates near-universal spam with no legitimate use for most sites. Despite this, trackbacks remain enabled by default on new WordPress posts.

An attacker submits two crafted trackbacks to any public post on the target site. Each trackback carries a trailing backslash and a URL pointing to the payload. WordPress trackback stores payload undetected to the wp_comments database table without stripping the backslashes or rejecting the URLs — no validation check fails, no alarm fires, no file is modified. The payload is now dormant, indistinguishable from ordinary spam. Standard WordPress security monitoring, which watches for new administrator accounts, modified plugin files, and injected code, sees nothing.

Everything the attacker needs to do is complete. All that remains is waiting

The Backup Runs — and the Secret Key Leaks

When the site administrator next exports the site or performs an archive restore, the All-in-One WP Migration plugin rewrites all URL and table prefix references in the stored SQL to reflect the new server environment. This rewrite routine processes the attacker’s previously stored trackback data as part of that SQL. The backup rewrite fires stored SQL, and the injected query executes

The injected SQL writes the plugin’s internal secret import key — stored in the WordPress options table as ai1wm_secret_key — into a new comment on the site, which WordPress marks as approved and makes publicly visible. The attacker retrieves this secret key by querying the site’s standard comments REST API endpoint: no credentials required, no special access needed, no action that appears unusual in access logs.

Armed with the secret key, the attacker uploads a crafted .wpress archive — the plugin’s own backup format — to the plugin’s import endpoint. The archive contains a malicious must-use plugin with arbitrary executable PHP code. This malicious archive achieves remote execution on the next page load

Wordfence classifies the outcome as “complete site compromise through the use of webshells and other techniques.” This means an attacker can install persistent backdoors, create new administrator accounts, exfiltrate the entire database, redirect visitors to malicious destinations, or use the compromised server as a platform for attacking other sites

Why 3.25 Million Sites Have Not Updated

The patch was available for 14 days before Wordfence published full technical details — an intentional coordinated disclosure held 14 days gap designed to give administrators time to update before attackers had a complete blueprint for exploitation

Despite that window, roughly 65 percent of the plugin’s user base had not updated by September 3, according to WordPress.org plugin update statistics. That figure — 3.25 million unpatched sites — is the number that frames the urgency. It is not a hypothetical future exposure: it is the current population of sites that may have planted payloads in their databases right now and have not yet applied the fix that eliminates the threat.

This pattern is well-documented across the WordPress ecosystem. The Patchstack 2026 WordPress security report found that 11,334 new WordPress vulnerabilities were discovered in 2025 — a 42 percent year-over-year increase — and that 46 percent of vulnerabilities are publicly disclosed before any developer patch is available. Among heavily targeted vulnerabilities, the five-hour weighted exploitation median from public disclosure to first mass exploitation attempt is five hours. The implication is direct: administrators who did not update in the 14 days before September 2 are now within that five-hour window.

CVE-2026-19949 adds a dimension that most other WordPress plugin vulnerabilities do not carry: because the payload was planted before public disclosure, administrators cannot rely on the absence of active exploitation as evidence of safety. If a payload is already in the wp_comments table, no monitoring tool flagged it when it arrived

ServMask’s Response and the Disclosure Gap for Free Wordfence Users

Security researcher Jack Taylor discovered the vulnerability and reported it on August 14, 2026, through Wordfence’s Bug Bounty Program, receiving a $5,761 bug bounty award

Wordfence validated the finding the following day and immediately notified ServMask. ServMask acknowledged the report on August 17 — two days after notification — and released version 7.110 on August 20, only five days from notification to patch. That response timeline is notably fast for a plugin developer

There is, however, a protection gap for site owners relying on the free tier of Wordfence. Wordfence deployed a firewall rule protecting Premium, Care, and Response subscribers on August 16 — the day after notifying ServMask. <a href="https://cybersecuritynews.com/wordpress-all-in-one-wp-migration-plugin-flaw/” rel=”nofollow noopener” target=”_blank”>Free-tier protection September 15 is when free-tier users will receive that firewall protection. This means that from the moment of public disclosure on September 2, free-tier users have no automated firewall protection for CVE-2026-19949 for 13 days. The plugin update is the only complete remediation during that period.

Read more:WordPress Email Plugin Flaw Triggers 17 Million Attacks: Gravity SMTP Leaks Live API Keys

What to Do Right Now

Update immediately. Navigate to your WordPress dashboard, select Plugins, locate All-in-One WP Migration and Backup, and update to version 7.110 or later. This is the only action that removes the vulnerability. If the plugin is currently deactivated but installed, update it anyway — Wordfence patch remediation guidance notes that a deactivated vulnerable version poses less risk, but can still be exploited if temporarily reactivated.

Disable trackbacks via WordPress Settings → Discussion → uncheck “Allow link notifications from other blogs (pingbacks and trackbacks).” This setting only applies to new posts; use the WordPress bulk-edit feature under Posts → All Posts to retroactively disable trackbacks on existing content. Note that disabling trackbacks now does not remove any payload already stored in the wp_comments table — it only prevents future payloads from arriving.

Audit your comments table for suspicious entries. Search your comments for any containing the string ai1wm_secret_key or other database value strings. If found, your secret key has already been exposed and you should treat your site as potentially compromised even after applying the patch

Check for unauthorized plugins and administrator accounts. If the attack chain was completed before you patched, the malicious .wpress archive may already have been imported. Inspect your must-use plugins folder (/wp-content/mu-plugins/) for unfamiliar files and review all administrator accounts in WordPress → Users

Review server logs for suspicious .wpress uploads. Look for POST requests to the All-in-One WP Migration import endpoint originating from external IP addresses, particularly around the time of any recent backup or restore operation

Does WordPress Contribute to This Risk?

CVE-2026-19949 raises a structural question that extends beyond ServMask’s specific implementation: WordPress’s plugin trust model gives any installed plugin broad access to internal hooks, database write access, and unauthenticated API endpoint registration. The ecosystem — with more than 60,000 publicly available extensions — is built on a model that prioritizes extensibility over isolation. A single error in one plugin’s SQL query construction can put millions of sites at risk.

What is specific to this vulnerability is that WordPress core’s decision to keep trackbacks enabled by default in 2026 provides attackers with a reliable, low-friction payload delivery surface that most administrators have never explicitly hardened. Disabling trackbacks is a one-checkbox operation in WordPress settings, but it requires the administrator to know it matters — and most do not

Frequently Asked Questions

How do I know if an attacker has already planted a payload on my site before today’s disclosure?

You cannot know for certain from a visual inspection of your site, because the stored payload is simply a comment entry in your wp_comments database table. It appears as a pending or spam comment, which is exactly what legitimate comment spam looks like. The indicators to check are: (1) review your comments queue and comment database for entries containing unusual URL patterns with trailing backslashes, or containing SQL meta-characters; (2) search specifically for any comment containing the string ai1wm_secret_key, which would indicate the payload has already fired and your secret key has been exposed; and (3) if you have server access logs, check for POST requests to your trackback endpoint (wp-trackback.php) from unusual IP addresses in the weeks before today’s disclosure. If you find evidence of a fired payload, treat your site as compromised regardless of patching status: conduct a full incident response, check for unauthorized administrator accounts, inspect your /wp-content/mu-plugins/ directory, and consider restoring from a pre-compromise backup. See Wordfence incident response guidance for full remediation steps.

Why can’t standard WordPress security plugins detect this attack before the backup runs?

Because there is nothing anomalous to detect at the moment the payload arrives. Second-order detection challenge explained: second-order SQL injection exploits the fact that databases are typically considered trusted internal storage — once data passes initial validation and is written to the database, most systems treat it as clean. The trackback submission itself contains backslashes and URLs, which are not inherently malicious — they look like ordinary spam content. The dangerous SQL context does not exist until the backup plugin processes that stored data and assembles a SQL query around it. A firewall that inspects incoming HTTP requests would have to specifically understand All-in-One WP Migration’s internal URL-rewrite logic to recognize the threat — and that level of plugin-specific context is exactly what Wordfence’s firewall rules (deployed August 16 for premium users, September 15 for free users) provide. The plugin update removes the vulnerability at its root: parameterized queries, which version 7.110 implements, would make it impossible for stored data to be promoted to executable SQL regardless of its content.

If I only use All-in-One WP Migration occasionally — say, once a year for a server migration — am I at lower risk?

The detonation risk is lower if you run backups infrequently, but the planting risk is the same as any other site. An attacker scanning for sites running vulnerable versions of the plugin can submit trackback payloads without knowing when your next backup will occur — they are placing dormant payloads at scale and waiting. Your infrequent backup schedule delays the trigger but does not eliminate it. The practical implication is that if you have not run a backup since the vulnerability was introduced (before August 20, when the patch was released), your database may contain an undetonated payload. Update to version 7.110 before your next backup operation. After updating, the SQL rewrite logic that would have promoted the payload to executable code is replaced with parameterized queries, so any dormant payload stored in your comments table becomes harmless even if the backup runs. See Wordfence plugin update guidance for full details on the patch’s effect.

What does second-order SQL injection mean, and why does it matter more than a regular SQL injection?

Second-order SQL injection — also called stored SQL injection — is a pattern in which the malicious payload does not execute when it is submitted to the application. Instead, second-order injection stores silently in the database as ordinary-looking data and only becomes dangerous when a different part of the application retrieves and reprocesses it in a SQL query. This matters more than conventional SQL injection from a detection standpoint because request-time security filters — which analyze incoming HTTP requests for SQL meta-characters — see nothing suspicious when the payload arrives. The dangerous SQL only exists inside the application’s second operation, and by then the security monitoring that watched the front door has already moved on. For CVE-2026-19949 specifically, this means the attack cannot be stopped at the trackback submission point by signature-based scanning alone: the threat is only materialized when the backup plugin’s URL-rewrite routine runs, which is an internal server-side operation invisible to most monitoring tools. See the Patchstack 2026 injection context for the broader landscape of second-order and stored injection risks in the WordPress ecosystem.

ⓒ 2026 TECHTIMES.com All rights reserved. Do not reproduce without permission

Tags:WordPress

Source: www.techtimes.com