Security Alert Summary
The All-in-One WP Migration and Backup plugin for WordPress contains a SQL injection vulnerability in its archive restore functionality. An attacker can inject additional SQL into existing queries due to insufficient escaping and query preparation, which can be used to extract sensitive data such as the ai1wm_secret_key and may lead to remote code execution if that key is later leveraged.
CVE Details
- CVE ID: CVE-2026-19949
- Affected component: All-in-One WP Migration and Backup plugin (archive restore functionality)
- Affected versions: All versions up to and including 7.109
- Published: August 25, 2026 at 12:16:23 PM UTC
- Last modified: August 25, 2026 at 12:16:23 PM UTC
- CVSS v3.1: Base score 8.8, Severity HIGH, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: CVSS data indicates
Privileges Required: LOW,User Interaction: NONE; attack vector = NETWORK, attack complexity = LOW, scope = UNCHANGED - Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness: CWE-89 (SQL Injection)
Technical Details
The vulnerability is a SQL injection in the plugin’s archive restore functionality. According to the advisory, the issue is caused by insufficient escaping of a user-supplied parameter and a lack of proper preparation of the existing SQL query. This allows an attacker to append additional SQL queries into existing statements executed by the plugin during restore operations.
The attack can be used to extract sensitive information from the database; the advisory specifically notes that the injected queries can be used to obtain the ai1wm_secret_key. If an attacker is able to retrieve that secret key and an appropriate follow-on technique is available, the advisory states this may be leveraged to achieve remote code execution. The description also refers to “unauthenticated attackers” being able to append queries, while the CVSS metrics indicate a low privilege requirement (PR:L). Both items are recorded in the source advisory.
No specific REST API endpoints or function names are stated in the description beyond the general archive restore functionality. The core technical cause is insufficient input escaping and lack of prepared statements when constructing SQL queries.
How This Could Impact Your Website
In a multi-user site scenario, an attacker who can exploit this vulnerability during an archive restore could extract database secrets or sensitive data. For example, a site owner asks an external contractor to restore a backup, and the restore process executes code in the plugin that is vulnerable to SQL injection. The attacker could use that opportunity to retrieve internal data such as user email addresses or secret keys. Internal staff or contributors with limited privileges may be able to trigger the vulnerable code path if the restore process is initiated while they have access.
Practical consequences include exposure of internal user email addresses and other sensitive records, which increases the risk of targeted phishing or social engineering against staff or contractors. The advisory notes the potential to obtain the plugin secret and, with additional technique chaining, the possibility of remote code execution; do not assume full site compromise is automatic from this issue alone, but recognize the elevated risk if secrets are disclosed.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially contributor-level and other low-privileged accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and database activity for unusual behavior around restores or administrative operations.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/controller/class-ai1wm-import-controller.php#L68
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/controller/class-ai1wm-main-controller.php#L1336
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/model/import/class-ai1wm-import-database.php#L1065
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1250
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1637
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1726
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3656677%40all-in-one-wp-migration&new=3656677%40all-in-one-wp-migration
- https://www.wordfence.com/threat-intel/vulnerabilities/id/22e273d9-a268-4dc5-b1f6-3bc5c29232c5?source=cve
