Executive Summary
A high-severity vulnerability (CVSS 8.8) has been identified in the All-in-One WP Migration and Backup WordPress plugin, affecting over 5 million installations. The flaw, tracked as CVE-2026-19949, is a second-order SQL injection that allows unauthenticated attackers to plant malicious payloads through WordPress trackbacks. These payloads remain dormant until a site administrator performs a routine export and import operation, at which point the injected SQL executes.
Technically, the vulnerability stems from incorrect parsing of escaped backslashes during database content rewriting. Attackers can leverage this to leak the plugin's secret import key (ai1wm_secret_key) via public comments. Once the key is obtained, the attacker can bypass unauthenticated access controls to upload a crafted archive containing malicious code, resulting in complete site takeover.
This vulnerability poses a significant risk to the WordPress ecosystem due to the plugin's popularity and the stealthy nature of second-order attacks. While exploitation requires an administrative action, backup and restoration are core functions of the plugin. Organizations using version 7.109 or earlier should update to version 7.110 immediately to mitigate the risk of remote code execution.