CVE-2026-19949: All-in-One WP Migration SQLi Vulnerability

CVE-2026-19949 Overview

CVE-2026-19949 is a SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress. The flaw affects all versions up to and including 7.109. It resides in the archive restore functionality, where user-supplied input is insufficiently escaped and the underlying SQL query lacks proper preparation [CWE-89].

Authenticated attackers with low privileges can append arbitrary SQL statements to existing queries and exfiltrate sensitive data from the WordPress database. The specific escalation path involves stealing the ai1wm_secret_key value while a site administrator performs an archive restore, which can then be leveraged to achieve remote code execution.

Critical Impact
Successful exploitation exposes the ai1wm_secret_key, enabling remote code execution on affected WordPress sites.

Affected Products

All-in-One WP Migration and Backup plugin for WordPress, versions ≤ 7.109
WordPress sites with the plugin installed and active
Sites where administrators perform archive restore operations while attackers observe or interact with the workflow

Discovery Timeline

2026-08-25 - CVE-2026-19949 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-19949

Vulnerability Analysis

The vulnerability exists in the archive restore workflow of the All-in-One WP Migration and Backup plugin. During restore operations, the plugin processes archive contents and issues SQL statements against the WordPress database using values derived from the imported archive without adequate sanitization.

Because the queries are constructed with concatenated strings rather than parameterized statements, an attacker who influences the archive contents or the associated request parameters can inject additional SQL clauses. The plugin code paths involved include class-ai1wm-import-controller.php, class-ai1wm-import-database.php, and the vendored class-ai1wm-database.php helpers referenced in the Wordfence Vulnerability Report.

Root Cause

The root cause is insufficient escaping of user-supplied parameters combined with missing SQL preparation on existing query strings. The vendored database class builds SQL fragments through string concatenation, allowing injected tokens to break out of the intended query context. This design places responsibility for sanitization on callers, which the import routines do not consistently provide.

Attack Vector

Exploitation occurs over the network against the WordPress admin interface. An attacker triggers or influences an archive restore workflow so that malicious input reaches the vulnerable query construction path. Appended SQL statements extract database contents, including the ai1wm_secret_key stored during administrator-initiated restores.

Once the attacker obtains ai1wm_secret_key, the value can be used to authenticate further plugin operations that lead to remote code execution on the underlying host.

No public proof-of-concept exploit is currently listed for CVE-2026-19949. See the WordPress Plugin Import Database source for the affected code path.

Detection Methods for CVE-2026-19949

Indicators of Compromise

Unexpected requests to admin-ajax.php or plugin endpoints referencing ai1wm_import handlers from non-administrator sessions
Anomalous archive uploads or restore operations outside of scheduled maintenance windows
Database queries containing SQL meta-characters or UNION SELECT fragments in web server or database logs tied to the plugin
Unexplained reads of the wp_options table entries containing ai1wm_secret_key

Detection Strategies

Inspect WordPress access logs for POST requests to All-in-One WP Migration endpoints originating from low-privilege accounts
Monitor for outbound requests or new administrative users created shortly after archive restore events
Deploy a web application firewall (WAF) rule set that flags SQL injection patterns in multipart archive import parameters

Monitoring Recommendations

Enable WordPress activity logging for plugin installation, import, and export events
Alert on any process spawned by the PHP worker that writes to plugin or theme directories after a restore operation
Ingest webserver, PHP-FPM, and MySQL logs into a centralized SIEM and correlate on plugin request patterns

How to Mitigate CVE-2026-19949

Immediate Actions Required

Update the All-in-One WP Migration and Backup plugin to a version newer than 7.109 as soon as the vendor releases a fixed build
Restrict archive restore operations to trusted administrators and limit access to the plugin's admin pages via IP allowlisting
Rotate WordPress administrator credentials and invalidate any stored ai1wm_secret_key values after upgrading

Patch Information

The vendor commit referenced in the WordPress Plugin Changeset addresses the vulnerable code paths. Site owners should upgrade to the patched release published by ServMask on the WordPress plugin repository and verify the installed version through the WordPress admin dashboard.

Workarounds

Deactivate and remove the All-in-One WP Migration plugin until a patched version is installed
Deploy WAF rules that block SQL injection payloads targeting admin-ajax.php actions used by the plugin
Limit the number of accounts holding subscriber or higher privileges, since exploitation requires an authenticated context

bash

# Example: restrict access to the plugin admin endpoint via Nginx
location ~* /wp-admin/admin-ajax\.php {
    # Allow only trusted admin IPs during restore operations
    allow 203.0.113.10;
    deny all;
}