Somewhere out there, a WordPress admin is patting themselves on the back for setting up automated backups. Meanwhile, the plugin doing those backups has a hole in it big enough to drive a botnet through. The irony writes itself.

A Trackback Walks Into a Restore Function

Security researchers at Defiant disclosed CVE-2026-19949, a second-order SQL injection flaw in the wildly popular All-in-One WP Migration and Backup plugin, installed on more than 5 million WordPress sites. The bug scores 8.8 on the CVSS scale and lets unauthenticated attackers achieve full remote code execution.

The attack chain is delightfully sneaky: a malicious actor submits a crafted trackback containing backslashes and a payload URL, which the plugin fails to properly escape. That poisoned data sits dormant until an admin archives or restores the site, at which point the plugin rewrites SQL queries and promotes the attacker's input into executable code, exposing a secret restore key in plain-sight comments and clearing the way for a malicious plugin import. ServMask patched the hole in version 7.110 on August 20, 2026.

The Patch Exists. The Problem Is Nobody Applied It

Here's the part that should sting: as of September 3, roughly 3.2 million installations, about 35% of the plugin's user base, still hadn't updated. That's not a vulnerability problem anymore; that's a "we know exactly how to fix this and chose not to" problem.

The sneaky bit most coverage glosses over: this isn't your typical smash-and-grab SQL injection. It hides in a totally mundane feature, an archive restore, that admins run all the time without a second thought, which is exactly why it's so effective.

A backup plugin becoming the attack vector for a full site takeover is the kind of plot twist nobody asked for.

If "did we actually patch that" is a question you can't answer with confidence for every plugin on your site, our free developer's security checklist walks through exactly how to close that gap.

Source: SecurityWeek