All-in-One WP Migration CVE-2026-19949: From Second-Order SQL Injection on Restore to Site Takeover

1. Basic Information

• Article Title: WordPress backup plugin flaw exposes millions of sites to takeover attacks
• Publisher: BleepingComputer
• Publication Date: 2026-09-02
• Original Source: BleepingComputer
• Related Sources: Wordfence technical analysis, Wordfence vulnerability record
• Related Malware / Threat Groups / CVEs / Products: CVE-2026-19949, WordPress, All-in-One WP Migration and Backup plugin <= 7.109
• Severity: High

2. Executive Summary

An attacker injects second-order SQL injection data via public WordPress input channels. When an administrator restores a backup, the plugin leaks its secret key. The attacker uses this key to upload a malicious .wpress archive, leading to remote code execution.

3. Attack Flow

From Second-Order SQL Injection to Malicious Archive Execution

1. An unauthenticated attacker saves crafted data to the database that breaks escape boundaries, using features like trackbacks.
2. An administrator exports, imports, or restores a backup.
3. When the plugin rewrites URLs or table prefixes, the stored data runs as an SQL query.
4. The attacker leaks and retrieves ai1wm_secret_key via public comments or similar methods.
5. Using the secret key, the attacker bypasses authentication during the import process to unpack a malicious .wpress archive containing executable code.
6. The code runs on the web server, resulting in site takeover.

4. Attacker Positioning and Execution Vectors

• Unauthenticated external attackers who can reach public WordPress input fields and the import endpoint of All-in-One WP Migration.
• Triggering the exploit requires the administrator to perform an archive operation, but no direct interaction with the attacker is necessary.

5. Visibility for Victims and Administrators

Victims

• The site appears normal to visitors, making defacements, redirects, or malware distribution difficult to notice.

Administrators

• Unusual quotes or backslashes in trackbacks or comments.
• Abnormal SQL queries during the restore process and the appearance of ai1wm_secret_key in public comments.
• .wpress imports from unknown sources, immediately followed by new PHP files and child processes spawned by the web process.

6. Success and Failure Conditions

Success Conditions

• The plugin version 7.109 or earlier is active.
• A public input path allows the attacker to save crafted data to the database.
• An administrator performs an archive operation on data containing the payload.
• The attacker can reach the import endpoint using the leaked secret key.

Failure Conditions / Risk Mitigation

• Update to version 7.110 or later, and remove unused old or disabled versions.
• Disable or strictly validate unnecessary public inputs like trackbacks.
• Restrict restore and import functions to an administrative network and rotate secret keys.

7. What Happens on Success

• Reading of sensitive information from the WordPress database.
• Leakage of the All-in-One WP Migration secret key.
• Arbitrary code execution and full site takeover via malicious archive extraction.
• Web defacement, credential theft, malware distribution, and attacks against visitors.

8. Observable Logs

• Email: None.
• Proxy/SWG/DNS: Trackbacks and comment posts from unknown sources, import requests, and communication to unknown destinations after compromise.
• Endpoint/EDR: Abnormal database operations during restore, unknown PHP files, and web server child processes.
• Identity/IdP: Administrator restore timestamps, and management API/import usage from unknown sources.
• SaaS/Cloud: WAF logs, WordPress audits, backup and restore history, and unknown archives uploaded to object storage.
• Network: Traffic from the web server to unknown external destinations, and internal reconnaissance after compromise.

9. Attack Success Assessment

• Attack Attempt Observed (Success Unconfirmed): Crafted public inputs are confirmed, but no restore operation has occurred yet.
• User Action Confirmed: Administrator export, import, or restore acts as the trigger.
• Initial Execution Confirmed: Suspicious SQL queries or the export of ai1wm_secret_key during restore is confirmed.
• Malware Execution or Authentication Success Confirmed: Unauthenticated import using the leaked secret key, or execution of malicious PHP is confirmed.
• Data Theft or Session Compromise Confirmed: Retrieval of database or secret information, or external exfiltration is confirmed.
• Post-Compromise Confirmed: Site defacement, web shells, distribution to visitors, or internal lateral movement is confirmed.

10. Investigation Playbook

• Trigger: Use of old versions, SQL errors during restore, secret key exposure, or unknown .wpress imports.
• Initial Check: Verify the plugin version, active duration, public inputs, restore/import timestamps, and source IPs, while preserving logs.
• Endpoints: Check for new or modified PHP files under WordPress directories, uploads, plugin folders, and child processes of the web server.
• Authentication & Cloud: Review usage history of WordPress administrators, ai1wm_secret_key, and database/hosting credentials.
• Post-Exploitation Actions: Check for defacements, unknown administrative accounts, outbound traffic, visitor distribution, and credential reuse across other sites.
• Containment: Put the site in maintenance mode, update to version 7.110 or later, rotate secret keys and related credentials, and isolate malicious files and archives.
• Classification: Separate payload injection, administrator action, SQL trigger, secret key leakage, archive upload, and code execution stages.

11. Defense and Detection Ideas

• Single Event: Multiple quotes or backslashes targeting SQL boundaries in public inputs; an unknown source importing a .wpress archive.
• Time-Series Correlation: Correlate public inputs -> restore days later -> SQL errors/secret key exposure -> unknown import -> PHP file creation across a long time window.
• Hunting: Search the entire active duration of older versions for trackbacks, comments, restores, ai1wm_secret_key, .wpress files, and modified PHP files.
• Log Gaps: Without logs for public input bodies, restore jobs, database audits, and file changes, tracing the cause of second-order injection is impossible.
• Prioritized Mitigations: Update to version 7.110 or later, remove old versions, rotate secret keys, restrict public inputs, and audit restores and imports.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-19949 is a second-order SQL injection vulnerability present in All-in-One WP Migration and Backup 7.109 and earlier. Version 7.110 was released on August 20, 2026.
• Attackers can save crafted data to the WordPress database using public input vectors such as trackbacks.
• The payload does not execute when saved; it triggers as an SQL query when an administrator exports, imports, or restores an archive using the plugin, which rewrites URLs and table prefixes.
• The SQL injection allows writing ai1wm_secret_key to public comments or similar locations.
• An attacker who obtains the secret key can use the unauthenticated import process to proceed to remote code execution via a malicious .wpress archive containing executable code.
• WordPress.org reports over 5 million active installations, with approximately 35% updated at the time of BleepingComputer's publication.

Inference

• Because routine backup restores act as the trigger for the attack, web access logs alone are insufficient; restore jobs and database modifications must be time-correlated.

Hypothesis

• At the time of publication, large-scale active exploitation has not been confirmed, and the actual number of compromised unpatched sites remains unknown.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (High): Chains public WordPress inputs and plugin restore processes.
• T1505.003 Server Software Component: Web Shell (Medium): Executable PHP can be deployed via malicious archives, although actual web shell observation is not detailed in the article.
• T1059.004 Command and Scripting Interpreter: Unix Shell (Low): Can occur after remote code execution, but no specific command execution was observed.

14. Unknowns and Further Investigation

• Presence of active exploitation and the number of compromised sites.
• Breakdown of the public input vectors actually used in real environments for payload injection.
• Specific payloads and persistence mechanisms used after uploading malicious archives.

15. Impact on SOCs

Corporate websites, public sector portals, educational institutions, and e-commerce platforms often use WordPress for migration and backups. Security teams should update or remove the plugin (including disabled old versions) to version 7.110 or later, and inspect past trackbacks/comments, restore histories, exposed ai1wm_secret_key instances, unknown .wpress imports, and newly created PHP files.

16. Summary by Target Audience

• For SOCs: Hunt for time-delayed chains consisting of public input -> administrator restore -> suspicious SQL -> secret key exposure -> .wpress import -> PHP execution.
• For Administrators: Update to version 7.110 or later, remove unused old versions, rotate secret keys, and review restore histories and new PHP files.
• For Users: This is not an attack that regular visitors can prevent. Report suspicious site redirects, defacements, or administrative anomalies to the site operators.