WordPress migration plugin flaw puts millions of sites at risk

A newly published flaw, CVE-2026-19949, carries a CVSS score of 8.8 and can end in full site takeover for WordPress sites running the All-in-One WP Migration and Backup plugin. ServMask, the plugin's maker, already shipped the fix in version 7.110 on August 20. The problem is how few sites have installed it.

The plugin sits on more than 5 million active sites. As of early September, only about 35 percent had moved to 7.110, which leaves roughly 3.2 million sites still on a vulnerable build, according to SecurityWeek citing WordPress.org data. That adoption gap, two full weeks after the patch shipped, is the number the wires keep repeating.

The bug is a second-order SQL injection (CWE-89) tied to the plugin's archive restore. An attacker can leave crafted data in a public input on the site, where it sits inert until an administrator runs the plugin's core job: exporting and then importing or restoring a backup archive. During that rewrite of URLs and table prefixes, the planted data can be promoted into a database query.

Wordfence (Defiant), which assigned the CVE, describes the downstream impact bluntly: "As with all remote code execution vulnerabilities, this can lead to complete site compromise through the use of webshells and other techniques." The chain can expose the plugin's internal import key and let an attacker load a malicious .wpress archive, which is what turns a backup tool into a route to remote code execution. Researcher Jack Taylor reported it through Wordfence.

The planted payload does not execute on its own. It triggers when an administrator runs a backup restore or import, which is exactly what this plugin exists to do. None of the primary write-ups report the flaw being widely exploited in the wild yet. The urgency is the install base and the plausibility of the trigger.

Because the payload hides in stored content, a planted chain would show up in recent comments and trackbacks, unexpected .wpress imports, and unfamiliar files in wp-content/mu-plugins/. The shape repeats a 2026 pattern in tools teams trust by default, from PaperCut's emergency zero-day patch to a JFrog Artifactory auth bypass under active exploitation: the fix ships fast, and the exposure lives in the sites that never apply it.

Some offers on this page may be paid placements or contain affiliate links.