CVE-2026-19949

Overview

CVE-2026-19949 is a high-severity SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress, developed by ServMask. The flaw affects all versions up to and including 7.109 and resides in the archive restore functionality. An attacker can exploit this to append malicious SQL queries, extracting sensitive database information, including the ai1wm_secret_key, which can then be leveraged for remote code execution. The vulnerability was published on August 25, 2026, with Wordfence as the assigning CNA. It carries a CVSS v3.1 base score of 8.8 (High) and is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation. Defenders should prioritize patching and monitoring for indicators of compromise.

Technical details

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The plugin fails to properly escape user-supplied parameters and lacks sufficient preparation of SQL queries in the archive restore logic. Vulnerable code paths are identified in class-ai1wm-database.php (lines 1250, 1637, 1726), class-ai1wm-import-database.php (line 1065), class-ai1wm-import-controller.php (line 68), and class-ai1wm-main-controller.php (line 1336). An attacker with low-level authenticated access can inject additional SQL queries during an archive restore operation, which is typically triggered by a site administrator. This allows extraction of the ai1wm_secret_key from the WordPress database, which can then be used to achieve remote code execution. The attack requires the ability to influence the restore process, either by having a low-privilege account that can initiate or manipulate the restore, or by tricking an administrator into performing a restore with a crafted archive.

Impact

Successful exploitation allows an authenticated attacker with low privileges to extract sensitive data from the WordPress database, most critically the ai1wm_secret_key. Once obtained, the attacker can escalate to full remote code execution on the WordPress server, enabling complete site compromise, data exfiltration, defacement, or use of the server as a pivot point for further attacks. The impact spans all three security pillars—confidentiality, integrity, and availability—all rated High. For defenders, this means potential loss of sensitive data, website takeover, and reputational damage. The presence on CISA KEV indicates that exploitation is already occurring in the wild, making immediate action critical.

Exploitation steps

1. Reconnaissance: Identify WordPress sites running the All-in-One WP Migration and Backup plugin at version 7.109 or earlier using tools like WPScan or Shodan queries targeting WordPress plugin fingerprints.
2. Obtain low-privilege access: Register or compromise a low-privilege WordPress account (e.g., subscriber or contributor role) on the target site.
3. Trigger archive restore: Wait for or socially engineer a site administrator to initiate an archive restore operation, or identify if the restore endpoint is accessible with lower privileges via class-ai1wm-import-controller.php (line 68).
4. Inject SQL payload: Craft a malicious request to the archive restore functionality with SQL injection payloads appended to the vulnerable user-supplied parameter, targeting the database query in class-ai1wm-database.php or class-ai1wm-import-database.php.
5. Extract ai1wm_secret_key: Use the injected SQL to query the WordPress options table (e.g., wp_options) and retrieve the value of the ai1wm_secret_key option.
6. Achieve remote code execution: Leverage the extracted ai1wm_secret_key to authenticate to the plugin's API endpoints and upload or execute arbitrary code on the WordPress server.

Indicators of compromise

• Network: Unusual HTTP POST requests to WordPress archive restore endpoints (e.g., paths handled by class-ai1wm-import-controller.php) containing SQL metacharacters or encoded SQL syntax in parameters; unexpected outbound connections from the web server process.
• Logs: WordPress or web server access logs showing repeated or anomalous requests to the All-in-One WP Migration import/restore endpoints from low-privilege user sessions; database error logs indicating malformed or unexpected SQL queries.
• File System: Unexpected PHP files or web shells created in the WordPress installation or upload directories; modifications to plugin files in the all-in-one-wp-migration directory.
• Database: Changes to the ai1wm_secret_key value in the wp_options table; unexpected new admin accounts or option value modifications; evidence of bulk data reads from sensitive tables.
• Process: Unusual child processes spawned by the web server (e.g., bash, curl, wget) following archive restore activity.

Mitigation and workarounds

Update the All-in-One WP Migration and Backup plugin to a version newer than 7.109, which includes the fix referenced in the plugin changeset. As interim mitigations, restrict archive restore functionality access to trusted administrators only, and implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the plugin's endpoints. Monitor database activity for suspicious query patterns, particularly reads from the wp_options table for the ai1wm_secret_key value. Additionally, consider disabling the plugin temporarily if immediate patching is not possible, and audit user roles to ensure least privilege.

Community reactions

The vulnerability was reported by Wordfence, which serves as the CNA for this CVE. Social media activity observed includes a post on Mastodon by RedPacketSecurity shortly after disclosure. Coverage has been picked up by automated vulnerability tracking services including VulDB, CVEFeed, and INCIBE-CERT. No significant independent researcher commentary or vendor statements beyond the Wordfence advisory have been identified at this time. The inclusion in CISA KEV has heightened urgency among defenders.

Additional resources

• Wordfence Advisory
• GitHub Advisory
• Plugin Changeset
• Vulnerable Import Controller
• Vulnerable Database Class
• INCIBE-CERT Alert