--- title: All-in-One WP Migration flaw puts WordPress sites at risk description: CVE-2026-19949 in All-in-One WP Migration could let attackers take over WordPress sites. Find out who is vulnerable and how to fix it. source: https://vitaminaweb.digital/en/blog/all-in-one-wp-migration-flaw-could-put-millions-of-wordpress-sites-at-risk lang: en --- ![All-in-One WP Migration flaw could put millions of WordPress sites at risk](https://vitaminaweb.digital/storage/blog/YURXp4LxC8atJZjTEksxX4kH.webp) A vulnerability in **All-in-One WP Migration and Backup**, one of WordPress’s most popular plugins, could allow attackers to take control of vulnerable sites. The flaw has been identified as **CVE-2026-19949** and affects plugin versions up to **7.109**. A fix was released in version **7.110**. The issue is particularly concerning because of its scale. All-in-One WP Migration has more than **5 million active installations**. At the beginning of September, approximately 35% of users had already updated, meaning around **3.25 million installations could still have been vulnerable** at that time. ## How the attack works The vulnerability is a **second-order SQL injection**. In practice, this means an attacker can insert malicious content into the database, but the attack does not necessarily happen right away. The code remains stored. The problem arises later, when an administrator uses the plugin to export or restore the site. During this process, the malicious content can be interpreted as an SQL instruction. In other words, a routine maintenance task could become the trigger for an attack. According to the published analysis, manipulated data can be introduced through WordPress trackbacks and then executed during export and import operations. ## From SQL injection to site takeover The risk goes beyond access to the database. Exploitation could allow an attacker to obtain a secret key used by the All-in-One WP Migration import process. With this key, the attacker could import a malicious `.wpress` file containing executable code. This turns the vulnerability into a **remote code execution (RCE)** scenario. In practice, an attacker could execute code in the server environment and, depending on the available permissions, take complete control of the site. From there, the attacker could alter pages, create administrative users, install backdoors, redirect visitors, or use the site to distribute malware. ## The plugin has been patched ServMask, the developer of All-in-One WP Migration, fixed the vulnerability in version **7.110**, released in August. Anyone using the plugin should therefore check the installed version immediately. **Versions 7.109 and earlier need to be updated.** But there is an important detail. Updating the plugin fixes the vulnerability, but it does not automatically rule out the possibility that a site was compromised before the update. For this reason, environments that remained vulnerable should also review logs, administrative users, recent changes to PHP files, unknown plugins, and unusual modifications within WordPress. ## The problem goes beyond a single plugin This case also highlights a recurring issue with WordPress. A site’s security does not depend on WordPress Core alone. It depends on the entire installed ecosystem: **WordPress + plugins + theme + server + PHP + database + settings + users.** Every plugin adds functionality, but it also adds a new dependency that needs to be updated, monitored, and maintained. And a backup plugin deserves special attention. Tools that can import, export, and restore databases and files have privileged access to the application. They should therefore be treated as critical infrastructure components. ## What to do now Anyone using All-in-One WP Migration should take three immediate steps: 1. Update the plugin to version **7.110 or later**. 2. Check the environment for signs of compromise. 3. Review the number of installed plugins and whether they are all necessary. This incident reinforces a basic rule of digital security: **A site does not remain secure simply because it was secure when it was launched.** Security depends on ongoing maintenance, vulnerability monitoring, and regular updates to the technologies that support the operation. Read next ## Keep fine-tuning Development ### [Web Application Security: A Strategic Guide from Vulnerability to Digital Maturity](https://vitaminaweb.digital/en/blog/web-application-security-a-strategic-guide-from-vulnerability-to-digital-maturity) This guide offers an in-depth strategic analysis of the main risks, best mitigation practices, and the integration of security into the software... 23 Feb, 2026 · 5 min Digital Trends and Insights ### [Low-Code and No-Code: When Marketing Stops Being a User and Starts Building Technology](https://vitaminaweb.digital/en/blog/low-code-and-no-code-when-marketing-stops-being-a-user-and-starts-building-technology) Low-code and no-code are redefining Marketing’s role in organizations. By allowing teams to create automations, integrations and digital solution... 16 Feb, 2026 · 5 min What's New in Digital ### [AI Agent vs. Chatbot: An In-Depth Analysis of Current Market Use Cases](https://vitaminaweb.digital/en/blog/ai-agent-vs-chatbot-an-in-depth-analysis-of-current-market-use-cases) Discover the differences between AI Agents and chatbots, and when to use each. A practical guide for marketing and technology professionals. 01 Aug, 2025 · 4 min