Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
A vulnerability in the All-in-One WP Migration and Backup WordPress plugin has left over 3 million websites exposed to remote code execution attacks. The flaw allows attackers to steal a secret key used during archive restoration, enabling them to deploy malicious plugins and compromise entire sites. While a patch was released in August, only a fraction of installations have been updated, leaving a significant number of sites at risk.
A high-severity vulnerability (CVE-2026-19949, CVSS score of 8.8) exists in the All-in-One WP Migration and Backup WordPress plugin, exposing over 3 million websites to remote code execution (RCE) attacks. The vulnerability stems from a second-order SQL injection issue within the archive restore functionality. Specifically, user-supplied input is not adequately escaped, and existing SQL queries are not properly prepared, allowing an attacker to submit two trackbacks to a public post, each containing a trailing backslash and a URL leading to a malicious payload.
The plugin packages sites into .wpress archives, enabling administrators to restore them on any server. The import operation is unauthenticated but protected by a secret key saved during each database-restore pass. An attacker can exploit this by retrieving the secret key from a site’s comments REST API endpoint and using it to import a crafted .wpress archive containing a malicious must-use plugin, leading to RCE.
All versions of the plugin up to 7.109 are affected, and a patch was released in version 7.110 on August 20th. Despite the availability of the patch, only 35% of installations have been updated as of September 3rd, meaning approximately 3.2 million sites remain vulnerable.
The plugin has over 5 million active deployments, making it a significant risk. Related news includes vulnerabilities in the MiniOrange plugin and the shutdown of Minimus. Additionally, there are ongoing concerns about Log4j RCE and Iranian hacker sanctions.