GoKawiilSQL injection bug in All-in-One WP Migration plugin leaves 3.25M sites vulnerable
Researcher Jack Taylor found a second-order SQL injection flaw, CVE-2026-19949, in the All-in-One WP Migration and Backup WordPress plugin, used on over five million sites. Attackers can plant malicious data via trackbacks that activates when an admin exports or imports a site, exposing a secret key that lets them upload a malicious archive containing executable code and seize control of the website.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the exploit hides in routine backup and migration tasks, site owners may trigger the attack themselves without realizing it, making detection unusually difficult. With roughly 3.25 million installations still running the vulnerable version despite a patch being available, this represents a large, largely unaddressed attack surface for full site takeovers.
- The flaw lets unauthenticated attackers gain full control of WordPress sites via a crafted trackback exploited during normal backup operations.
- Only about 35% of the plugin's 5 million+ users have updated to the fixed version, leaving millions exposed.
- Site administrators should update the plugin immediately and review comments/trackbacks for suspicious injected content.
Samsung T7 Portable SSD — When a backup plugin itself becomes the attack surface, having your own offline copy of a site archive matters. The Samsung T7 is a pocket-sized USB-C SSD with hardware password protection, making it an easy place to stash exported WordPress databases and media outside the server.
See Samsung T7 Portable SSD on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-02
Published there as: “WordPress backup plugin flaw exposes millions of sites to takeover attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.