CVE-2026-19949

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.110

Description An unauthenticated second-order SQL injection exists in the archive restore functionality. This occurs because user-supplied parameters are insufficiently escaped and SQL queries are not properly prepared. An attacker can plant malicious payloads via WordPress trackback pings, which remain dormant until a site administrator performs an export and subsequent import or restore operation. During this process, the replace table values() function in Ai1wm Database mishandles backslash runs at string boundaries, transforming the stored data into executable SQL.

This flaw can be used to extract the ai1wm secret key from the database and leak it through the unauthenticated REST comments endpoint. With this secret key, an attacker can import a crafted .wpress archive containing a malicious must-use plugin into the wp-content/mu-plugins/ directory, leading to remote code execution (RCE) as the web server user and complete site takeover. Approximately 3.2 million installations are estimated to be potentially affected worldwide.

Recommendations Update All-in-One WP Migration and Backup to version 7.110 or later. As a temporary mitigation, restrict the acceptance of trackbacks and pingbacks. Limit the import of .wpress archives to trusted administrators only.