CVE-2026-19949
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL injection in the archive restore functionality in all versions up to and including 7.109 due to insufficient escaping and lack of query preparation. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database, including the `ai1wm_secret_key`, and achieving remote code execution.
Risk Assessment
The risk is high because unauthenticated attackers can access sensitive data and potentially take over the server if an administrator performs an archive restore.
Recommendation
Immediately update the plugin to the latest patched version. Also, avoid performing archive restores until the fix is applied.
Other vulnerabilities in All-in-One WP Migration and Backup
See all- CVE-2026-17533High
The All-in-One WP Migration and Backup WordPress plugin before version 7.108 does not restrict migration import to network administrators on multisite, allowing a subsite admin to execute arbitrary PHP code across the entire network.
- CVE-2026-12898Medium
The All-in-One WP Migration and Backup WordPress plugin before version 7.106 does not properly sanitize a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Original NVD description (English source)
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.