A WordPress backup tool designed to help sites recover from trouble can instead become the trigger for an attack.
Researchers disclosed a high-severity SQL injection vulnerability in the All-in-One WP Migration and Backup plugin that affects version 7.109 and earlier. Although the flaw has been patched in version 7.110, an estimated 3.25 million sites were still running vulnerable versions as of Sept. 2, according to Bleeping Computer.
Tracked as CVE-2026-19949, the vulnerability can expose sensitive database information and, under certain conditions, reveal a plugin secret key that researchers say can provide a path toward remote code execution.
How the second-order SQL injection works
The flaw was discovered by Jack Taylor, who reported it to Wordfence via its bug bounty program on Aug. 14. Wordfence subsequently alerted ServMask, the developer behind the plugin, and described the flaw as a second-order SQL injection attack.
An attacker can first store malicious input in the WordPress database, then wait for the site to perform an operation the plugin was designed to handle: exporting or restoring an archive.
That delayed execution is what makes the flaw a second-order SQL injection. The malicious input is stored rather than executed immediately and only becomes dangerous when the plugin later retrieves it during an archive operation and passes it into a vulnerable database query.
At that point, the stored data can be interpreted as SQL, allowing the attacker to access information from the WordPress database.
Among the information that can be exposed is the plugin’s secret key, which researchers found can provide a path toward remote code execution. This can ultimately allow an attacker to take control of the affected WordPress site.
The risk, then, is not simply that an attacker can inject SQL into a vulnerable site. It is that the attack can be planted in advance and triggered by a legitimate administrative action that users of a backup and migration plugin are reasonably expected to perform.
All-in-One WP Migration and Backup has more than 5 million active installations, although that does not mean all of them are vulnerable, according to BleepingComputer’s Sept. 2 report.
Why high-privilege WordPress plugins make attractive targets
Plugins that handle backups, user registration, page building and other administrative functions often interact with sensitive parts of a WordPress installation.
That level of access makes vulnerabilities in those tools especially valuable to attackers because a single flaw can expose databases, user accounts or other critical site functions.
In March this year, a flaw in the User Registration & Membership plugin was discovered, allowing attackers to create admin accounts on WordPress websites. That same month, a flaw in the Elementor Ally plugin exposed over 400,000 sites to data theft.
The pattern is becoming harder to ignore. The more control a plugin gives an administrator, the more valuable a flaw in that plugin can become to an attacker.
Backup tools, registration systems, page builders, and other plugins sit close to important parts of a WordPress site, meaning a single security mistake can turn a convenience feature into an entry point for compromise.
What site administrators should do now
Anyone running the All-in-One WP Migration and Backup plugin, your first action item is to update to version 7.110 — the patched version.
Beyond that, this is a good reminder to take a closer look at every plugin running on your WordPress site. A plugin may be doing something useful in the background, but if it is outdated, it can quietly become the weakest point in your site’s security.
Check your installed plugins, remove the ones you no longer use, and keep the rest updated as security fixes become available. WordPress allows site administrators to auto-update their plugins, so if you are the kind that is more likely to skip a manual check, using auto-updates may be the best choice for you.
The immediate priority, however, is straightforward: if All-in-One WP Migration and Backup is installed, make sure it is no longer running an affected version.
Other news: Coder disclosed a supply chain attack in which hackers hijacked its trusted registry path to distribute malicious Terraform modules that stole cloud, CI/CD, AI-tooling, and SSH credentials during a roughly 14-hour window.