WordPress migration plugin flaw leaves millions of sites exposed
Image: Primary Wordfence reported that CVE-2026-19949, a second-order SQL-injection flaw in All-in-One WP Migration and Backup through version 7.109, can lead to remote code execution and takeover of affected WordPress sites. An unauthenticated attacker can plant data through trackbacks that executes when an administrator exports and imports a site, potentially exposing the plugin's import key and enabling a malicious archive. ServMask fixed the issue in version 7.110, but the report says about 3.25 million sites remain on vulnerable releases.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
