CVE-2026-19949Patch

HIGHCVSS 8.8 · HIGH

Exploitation observed; activity peaked at 11 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
36 mentions across 13 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 23 signals
Technical details provided in 24 signals
Disclosure: 8 classified signals
General: 4 classified signals
Peaked 10d ago at 11 mentions (2026-09-03); latest day: 1
36 total mentions across 13 days

Deep dive

Activity timeline36 mentions / 13d

Signal classification5 categories

Patch

2055.6%

Disclosure

822.2%

General

411.1%

PoC

38.3%

Active Exploitation

12.8%

Referenced assets21 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-01	1	Patch1
2026-09-02	5	Active Exploitation1Disclosure3Patch1
2026-09-03	11	Disclosure3Patch8
2026-09-04	5	General1Patch4
2026-09-05	2	Patch2
2026-09-06	1	Patch1
2026-09-08	3	General3
2026-09-11	2	Disclosure1Patch1
2026-09-13	1	Patch1
2026-09-15	1	PoC1
2026-09-16	2	Patch1PoC1
2026-09-22	1	Disclosure1
2026-09-23	1	PoC1

Full discourse20 posts

elhacker.NET@elhackernet44d
Disclosure
Fallo en plugin All-in-One WP Migration and Backup de WordPress expone 5 millones de sitios a ataques SQLi Se ha detectado una vulnerabilidad de alta gravedad (CVE-2026-19949) en el plugin All-in-One WP Migration and Backup de WordPress https://blog.elhacker.net/2026/09/fallo-en-plugin-all-in-one-wp-migration.html
Post summary
A blog post announces a high‑severity vulnerability (CVE‑2026‑19949) in the All‑in‑One WP Migration plugin but provides no technical specifics or mitigation information.
110243175.0K
142.4K followersView on X
Rıdvan Yağlı@ridvanyagli32d
PoC
CVE-2026-19949, WordPress'te All-in-One WP Migration and Backup eklentisindeki açık için yayınlanan PoC's: https://github.com/katranSefa/CVE-2026-19949 https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949
Post summary
The text announces and shares Proof of Concept (PoC) code repositories for CVE-2026-19949, a vulnerability in the WordPress All-in-One WP Migration and Backup plugin.
0302071.5K
2.5K followersView on X
Entre Kaczynski y Chinaski@686f6c6124d
PoC
Hace poco creé un laboratorio interno para reproducir y entender la CVE-2026-19949 en All-in-One WP Migration (AIOWPM) para WordPress, con una PoC funcional y un payload de prueba. La vulnerabilidad ya está parcheada. https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949
Post summary
The author describes creating an internal lab to reproduce CVE-2026-19949 in All-in-One WP Migration, shares a functional PoC with a test payload via a GitHub link, and notes the vulnerability is already patched.
1111951.9K
3.5K followersView on X
Rıdvan Yağlı@ridvanyagli45d
Disclosure
🚨 WordPress'te milyonlarca siteyi etkileyen kritik güvenlik açığı! All-in-One WP Migration and Backup eklentisinde tespit edilen CVE-2026-19949 (CVSS 8.8), kimlik doğrulaması gerektirmeyen ikinci dereceden SQL Injection zinciri üzerinden Remote Code Execution ve site ele geçirmeye yol açabiliyor. Açık 7.109 ve önceki sürümleri etkiliyor. Güvenlik araştırmacısı Jack Taylor tarafından keşfedildi ve 7.110 sürümünde düzeltildi. Eklentinin 5 milyondan fazla aktif kurulumu bulunuyor. Güncelleme yapmadıysanız mutlaka yapın!
Post summary
CVE‑2026‑19949 is a second‑order SQL injection in All‑in‑One WP Migration that can lead to remote code execution; a patch is available in version 7.110 and sites should update immediately.
021932.4K
2.4K followersView on X
Webologie@Webologie_me44d
Patch
🚨Si tu as un site sous WordPress, ce post est pour toi. Plus de 5 millions de sites utilisent le plugin All-in-One WP Migration. Une faille critique (CVE-2026-19949, score 8.8/10) touche toutes les versions jusqu’à la 7.109. Le piège, un attaquant dépose une charge malveillante d’apparence anodine via un simple trackback. Elle reste dormante jusqu’à ce que tu restaures une sauvegarde, geste banal et régulier. C’est ce moment précis qui déclenche la prise de contrôle totale du site. Corrigée le 20 août dans la version 7.110. Si tu utilises ce plugin, mets-le à jour maintenant. Vérifie aussi tes commentaires récents et ton historique de restaurations.
Post summary
The post announces the discovery of CVE‑2026‑19949 in the All‑in‑One WP Migration plugin, outlines the exploitation method, and emphasizes that the vulnerability was patched in version 7.110.
03073928
10.5K followersView on X
Abel Losada #DoNoEvil #BuildUtopia@TheDevilOps32d
PoC
cc: @constrainterror @jreypo @patowc @seguridadyredes Maravilloso @686f6c61 https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949
Post summary
Tweet shares a GitHub link to a PoC repository for CVE-2026-19949 (AIOWPM). No technical details, patches, or active exploitation claims are present in the text itself.
31061529
6.0K followersView on X
DEGEN 👑@iamjustape45d
Patch
Good morning. 🌅 Your WordPress backup plugin might be the vulnerability. All-in-One WP Migration and Backup: 5M+ installs, CVE-2026-19949, ~3.25M sites still unpatched. The trigger? Just... backing up your site. Its actual job. Update to 7.110 today. Have a good Thursday. 🔐 https://t.co/1Tg9Tdbz0w
Post summary
The tweet announces the CVE-2026-19949 vulnerability in the All-in-One WP Migration and Backup plugin and urges users to update to version 7.110 to apply the patch.
30030379
4.0K followersView on X
BugShield@BugShieldWP45d
Patch
🚨 All-in-One WP Migration vulnerability affects 5+ million WordPress sites. Versions 7.109 and earlier are affected by a high-severity SQL injection vulnerability (CVE-2026-19949). If you use the plugin, update to 7.110+. Full breakdown 👇 https://bugshield.co.uk/blog/all-in-one-wp-migration-sql-injection #WordPress #WordPressSecurity #CVE
Post summary
High‑severity SQL injection in All‑in‑One WP Migration 7.109 and earlier; users are prompted to update to 7.110+ for remediation.
11040102
20 followersView on X
Pedram Soheil@psoheil43d
Patch
Over 3 million WordPress websites may be exposed to a serious security vulnerability in the All-in-One WP Migration and Backup plugin. CVE-2026-19949 is a high-severity second-order SQL injection vulnerability with a CVSS score of 8.8. Under certain conditions, an unauthenticated attacker could steal the plugin’s secret key and ultimately achieve remote code execution, potentially resulting in complete site compromise. The vulnerability affects versions up to 7.109 and was patched in version 7.110, released August 20. However, as of September 3, only about 35% of installations had been updated. This is another reminder that third-party plugins can significantly expand the attack surface of otherwise well-maintained applications. If you manage WordPress infrastructure, check your installations and make sure All-in-One WP Migration and Backup is running version 7.110 or later. #Cybersecurity #WordPress #Vulnerability #WebSecurity #ApplicationSecurity #SQLInjection #RCE #InfoSec #PatchManagement https://www.securityweek.com/over-3-million-wordpress-sites-affected-by-migration-plugin-vulnerability/
Post summary
The post announces CVE‑2026‑19949, a severe SQL injection in the All‑in‑One WP Migration plugin leading to remote code execution. A patch is available (v7.110), but only 35% of affected sites have applied it, urging administrators to upgrade.
00130208
29 followersView on X
NEXSIGHT@NEXSIGHTNEWS44d
Patch
WordPress移行プラグインにSQLインジェクション（CVE-2026-19949） — 500万超サイトに影響、復元操作時の秘密鍵窃取からRCEのおそれ、7.110で修正済み https://cyber.nexsight.co/articles/2026/09/04/all-in-one-wp-migration-cve-2026-19949-sqli-rce-2026-09-04/
Post summary
The tweet reports a SQL injection vulnerability (CVE-2026-19949) in a WordPress migration plugin affecting over five million sites, which could lead to secret key theft and remote code execution during restore operations; it notes that the issue has been addressed in version 7.110. The post highlights the availability of a patch but does not mention proof‑of‑concept code, active exploits, or any false positive claims.
001202.5K
77 followersView on X
The CyberSec Guru@thecybersecguru44d
Patch
🚨 3.2 MILLION WordPress sites may be exposed to RCE. A high-severity vulnerability, CVE-2026-19949, affects the popular All-in-One WP Migration & Backup plugin. 🔴 CVSS 8.8 🔓 Unauthenticated attack path 💥 Remote Code Execution 🧨 Malicious payloads can lead to full server compromise ⚠️ Millions of installations may still be unpatched The fix is available in v7.110. If you run WordPress, check this NOW. Full technical breakdown + mitigation 👇 https://thecybersecguru.com/news/cve-2026-19949-wp-migration-rce/ #WordPress #CyberSecurity #CVE #AllinOneWP #RCE #InfoSec #Security #WordPressSecurity #CyberAttack
Post summary
The post highlights the high‑severity CVE-2026-19949 affecting the All‑in‑One WP Migration plugin, with a publicly available patch (v7.110) and detailed technical information, but no evidence of current exploitation or PoC.
00030201
1.6K followersView on X
Rw-CSIRT@Rw_csirt39d
General
Security Alert: High-Severity WordPress Plugin Vulnerability - CVE-2026-19949 https://cyber.gov.rw/updates/article/security-alert-high-severity-wordpress-plugin-vulnerability-cve-2026-19949/
Post summary
The text announces a high‑severity WordPress plugin vulnerability (CVE‑2026‑19949) but provides no additional details.
0101072
395 followersView on X
MLAUNCHER@MLUNCHER25d
Disclosure
آسیب پذیری با شناسه CVE-2026-19949 و از نوع SQLi در افزونه ی وردپرسی All-in-One WP Migration and Backup گزارش و اصلاح شده که به مهاجم بدون احرازهویت، امکان اجرای کد از راه دور و در نهایت تصاحب کامل سایت رو میده. برای اکسپلویت موفق، پیلود زمانی اجرا میشه که ادمین اقدام...
Post summary
The post discloses CVE-2026-19949, an SQL injection flaw in the All-in-One WP Migration and Backup WordPress plugin that allows unauthenticated attackers to achieve remote code execution and full site compromise, noting the issue has been reported and fixed without detailing the specific patch.
0001044
11 followersView on X
サイトドック｜Webセキュリティ解説一ノ瀬あかり@sitedock_jp41d
Patch
All-in-One WP Migration(500万サイト)にSQLインジェクション CVE-2026-19949。厄介なのは、仕込まれたデータが管理者のエクスポート操作で初めて発火する二次的な型であること。7.110更新と、更新までの一時対応をまとめました。
Post summary
The post notes a SQL injection flaw in All‑in‑One WP Migration (CVE‑2026‑19949) that activates only during admin export, and announces the 7.110 patch plus interim mitigations.
1000041
9 followersView on X
TokyoBlackHatNews@TYOBlackHatNews43d
General
CVE-2026-19949、数百万件のWordPressサイトが脆弱なバージョンのプラグインを稼働中 https://blackhatnews.tokyo/archives/136581
Post summary
The article highlights that millions of WordPress sites are running a vulnerable plugin associated with CVE-2026-19949, but it provides no further technical details, exploits, or mitigation information.
0001042
33 followersView on X
Sahed R. Neka@nekasahed44d
Patch
All-in-One WP Migration and Backup shipped 7.110 on 20 August. It patches CVE-2026-19949. CVSS 8.8. Unauthenticated SQL injection through archive restore, with a path to remote code execution. Every version up to 7.109 is affected.
Post summary
Version 7.110 of All-in-One WP Migration and Backup includes a patch for CVE-2026-19949, which is an unauthenticated SQL injection leading to remote code execution; the update addresses the issue for all prior affected versions.
1000050
107 followersView on X
Hunt.io@Huntio44d
Patch
⚠️ Millions of WordPress Sites Exposed by All-in-One WP Migration Bug https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/ A high-severity flaw in the All-in-One WP Migration and Backup plugin can lead to remote code execution and full site takeover under the right conditions. Tracked as CVE-2026-19949, the bug is a second-order SQL injection that can eventually expose the plugin’s secret import key and allow a malicious backup archive to be imported. An estimated 3.2 million WordPress sites remain exposed. The issue is fixed in version 7.110. #ThreatIntel #WordPress #CyberSecurity #InfoSec
Post summary
The Post‑mortem details a high‑severity second‑order SQL injection in All‑in‑One WP Migration that enables remote code execution and full site takeover, with 3.2 million WordPress sites affected; the flaw is fixed in plugin version 7.110.
00001470
7.1K followersView on X
Diario฿itcoin@DiarioBitcoin44d
Patch
🚨 Falla crítica en WordPress afecta a 5 millones de sitios CVE-2026-19949 permite inyección SQL vía trackbacks, robo de la clave y ejecución remota de código. Actualiza All-in-One WP Migration a 7.110 y revisa cambios no autorizados. https://t.co/SofX3Exl0w
Post summary
The tweet highlights a critical WordPress CVE (CVE-2026-19949) that enables SQL injection and remote code execution, urging users to update All‑in‑One WP Migration to version 7.110 as a mitigation.
10000523
213.4K followersView on X
Günter Born@etguenni45d
Disclosure
#WordPress Plugin All-in-One WP Migration and Backup mit #Sicherheitslücke CVE-2026-19949 https://borncity.com/blog/2026/09/03/wordpress-plugin-all-in-one-wp-migration-and-backup-mit-sicherheitsluecke-cve-2026-19949/
Post summary
The tweet announces the discovery of vulnerability CVE-2026-19949 in the All-in-One WP Migration and Backup WordPress plugin and points to a blog post for further details.
01000230
2.8K followersView on X
CCB Alert@CCBalert45d
Disclosure
Warning: Critical SQL injection in the #ServMask “All-in-One WP Migration and Backup” plugin. CVE-2026-19949 CVSS: 8.8. Unauthenticated attackers can extract sensitive data from the database, including administrator keys. More info: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/all-in-one-wp-migration/all-in-one-wp-migration-and-backup-7109-unauthenticated-second-order-sql-injection-via-archive-restore-to-remote-code-execution #Patch #Patch #Patch
Post summary
The post announces a critical SQL injection vulnerability (CVE-2026-19949) in the All‑in‑One WP Migration plugin, detailing its severity (CVSS 8.8) and attack vector, but does not provide PoC, exploit code, active exploitation evidence, or a patch.
00001397
7.2K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-19949

Rıdvan Yağlı[verified]@ridvanyagliPoC

The text announces and shares Proof of Concept (PoC) code repositories for CVE-2026-19949, a vulnerability in the WordPress All-in-One WP Migration and Backup plugin.

Entre Kaczynski y Chinaski[verified]@686f6c61PoC

The author describes creating an internal lab to reproduce CVE-2026-19949 in All-in-One WP Migration, shares a functional PoC with a test payload via a GitHub link, and notes the vulnerability is already patched.

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

CVE‑2026‑19949 is a second‑order SQL injection in All‑in‑One WP Migration that can lead to remote code execution; a patch is available in version 7.110 and sites should update immediately.

Webologie[verified]@Webologie_mePatch

The post announces the discovery of CVE‑2026‑19949 in the All‑in‑One WP Migration plugin, outlines the exploitation method, and emphasizes that the vulnerability was patched in version 7.110.

Abel Losada #DoNoEvil #BuildUtopia[verified]@TheDevilOpsPoC

Tweet shares a GitHub link to a PoC repository for CVE-2026-19949 (AIOWPM). No technical details, patches, or active exploitation claims are present in the text itself.

DEGEN 👑[verified]@iamjustapePatch

The tweet announces the CVE-2026-19949 vulnerability in the All-in-One WP Migration and Backup plugin and urges users to update to version 7.110 to apply the patch.

BugShield[verified]@BugShieldWPPatch

High‑severity SQL injection in All‑in‑One WP Migration 7.109 and earlier; users are prompted to update to 7.110+ for remediation.

Pedram Soheil[verified]@psoheilPatch

The post announces CVE‑2026‑19949, a severe SQL injection in the All‑in‑One WP Migration plugin leading to remote code execution. A patch is available (v7.110), but only 35% of affected sites have applied it, urging administrators to upgrade.