Loading story…
A high-severity unauthenticated second-order SQL injection flaw, CVE-2026-19949 (CVSS 8.8), affects the All-in-One WP Migration and Backup WordPress plugin through version 7.109, exposing roughly 5 million sites. Attackers can plant malicious data through unauthenticated WordPress trackbacks; the payload is triggered only if an administrator later exports and restores the affected site using the plugin, where faulty regular-expression handling converts stored comment data into executable SQL.
Successful exploitation can expose the plugin's ai1wm_secret_key, allowing an attacker to invoke its unauthenticated import action with a crafted .wpress archive. That archive can install a malicious must-use plugin and yield remote code execution, potentially resulting in complete site compromise. ServMask addressed the flaw in version 7.110; Wordfence released a firewall rule to paid customers and scheduled free-tier coverage for September 15.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
As of September 3, 2026, approximately 35% of All-in-One WP Migration and Backup installations had updated to version 7.110. Roughly 3.2 million sites remained on versions vulnerable to CVE-2026-19949.
CVE-2026-19949, affecting All-in-One WP Migration and Backup versions through 7.109, was publicly disclosed. The flaw is a high-severity second-order SQL injection issue in archive restoration that can lead to extraction of ai1wm_secret_key and ultimately remote code execution.
ServMask released version 7.110 of All-in-One WP Migration and Backup, patching CVE-2026-19949, a CVSS 8.8 flaw that could ultimately enable remote code execution when a vulnerable site's administrator exports and restores attacker-seeded trackback data.
ServMask acknowledged the report concerning CVE-2026-19949 in its All-in-One WP Migration and Backup plugin.
Wordfence deployed a firewall rule protecting Premium, Care, and Response customers from attempts to exploit CVE-2026-19949.
The All-in-One WP Migration and Backup vendor received full disclosure of CVE-2026-19949, affecting plugin versions through 7.109.
Researcher Jack Taylor submitted the unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup plugin through the Wordfence Bug Bounty Program.
Technical reporting identified the vulnerable replace_table_values() database-rewrite routine and described how malformed trackback data can escape a SQL string during archive restoration. The described chain uses staged payloads to obtain ai1wm_secret_key through WordPress comments and then imports a crafted archive containing a persistent must-use plugin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
12 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecysecurity.news
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcecve.circl.lu
Open sourcewordfence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 29, 2026
Attackers targeted multiple widely used WordPress plugins with critical flaws that enabled site takeover, malware deployment, and remote code execution. The most prominent issue, `CVE-2024-27956` in **WP-Automatic** before version `3.9.2.0`, was exploited through SQL injection to bypass authentication, create rogue administrator accounts, upload malicious files, and fully compromise websites; defenders were told to watch for suspicious admin usernames beginning with `xtw`, renamed WP-Automatic files, and known malicious file hashes. CSIRT.SK also reported more than **5.5 million** exploitation attempts across several WordPress plugin vulnerabilities, including `CVE-2024-27956`, `CVE-2024-2876`, `CVE-2024-2417`, and `CVE-2024-28890`. Separate advisories warned that **Forminator** versions earlier than `1.29.3` contained a critical unrestricted file upload flaw, `CVE-2024-28890`, that could let remote attackers execute code on the server, alongside `CVE-2024-31077` and `CVE-2024-31857`, which exposed sites to SQL injection and cross-site scripting. CSIRT.SK also flagged **Poll Maker** before version `3.4` for `CVE-2024-32514`, an arbitrary file upload vulnerability that could lead to remote code execution. The combined disclosures showed active attacker focus on vulnerable WordPress plugins as an initial access path, prompting urgent patching and compromise checks across exposed sites.
Jul 24, 2026
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026