Loading vulnerability…
CVE-2026-19949 is a second-order SQL injection vulnerability in ServMask All-in-One WP Migration and Backup for WordPress through version 7.109. The archive restore database-rewrite routine, including Ai1wm_Database::replace_table_values(), insufficiently escapes attacker-controlled data and inadequately prepares SQL queries. Faulty handling of backslashes and quoted SQL strings can cause stored trackback content to escape its intended string context when an administrator later exports and restores or imports an archive. The injected SQL can extract database data, including the plugin's ai1wm_secret_key. The recovered key can authorize the plugin's otherwise unauthenticated archive-import action, enabling import of an attacker-controlled archive containing a malicious must-use plugin.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This 32-file repository is a functional, Docker-reproducible exploit PoC for CVE-2026-19949 affecting ServMask All-in-One WP Migration and Backup through version 7.109. It is not a framework module. The primary implementation is split across Bash, Python, and PHP: exploit/01_plant_trackback.sh sends an unauthenticated trackback whose author ends in backslashes and whose URL contains a carefully structured SQL payload; aiowpm_client.py reproduces the plugin's priority-driven AJAX export/import workflow; exploit/07_leak_key.sh reads the resulting secret from the public WordPress comments REST API; and 05_build_wpress.py plus 06_rce_unauth.py produce and anonymously import a malicious .wpress archive after obtaining the key. The archive installs exploit/mu_plugin.php as a must-use plugin, demonstrating PHP execution with local marker files rather than a shell. The Makefile orchestrates the full chain and a patched 7.110 negative control. Docker configuration provisions WordPress, MySQL 8, plugin version 7.109 by default, a public post with trackbacks enabled, and predictable local credentials for the self-contained lab. The investigacion/ PHP utilities are research harnesses and fuzzers that replicate the vulnerable regex and validate generated SQL against MySQL. README files and web/index.html document the root cause, payload mechanics, detection, and mitigation. A scan mode in cli/poc.py provides non-invasive version detection, but the repository also contains complete exploitation and post-disclosure code, so it is not merely a detection tool.
The repository consists of one Python 3 program, CVE-2026-19949.py (approximately 39 KB), and is not part of a recognized exploit framework. It is an operational bulk exploitation utility rather than a detection-only proof of concept: it accepts multiple targets, uses a thread queue and worker threads, disables TLS certificate verification, and maintains result, vulnerability, credential, and failure output files. The stated target is the ServMask All-in-One WP Migration WordPress plugin through version 7.109. Its advertised chain is authenticated migration-archive upload/import, SQL injection through database.sql processing, recovery of ai1wm_secret_key or attempted creation of an administrator account, followed by deployment of a PHP shell. The script also contains default WordPress credential lists and logic advertised as REST user enumeration and XML-RPC brute forcing, giving it credential-attack capability independent of the alleged SQLi chain. The supplied content is truncated, so only static local artifacts and the shell filename are directly fingerprintable here; remote WordPress route strings are not fully visible in the provided excerpt. The CVE attribution and vulnerability claims should be independently validated before relying on them.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SQL-инъекция в плагине WordPress All-in-One WP Migration and Backup до версии 7.109 включительно. Неаутентифицированный атакующий может внедрить данные через trackback-запрос, которые активируются при последующем резервном копировании и импорте сайта. Это позволяет раскрыть ключ ai1wm_secret_key, импортировать злонамеренный .wpress-архив с must-use плагином и добиться удаленного выполнения кода с полным компрометированием сайта.
An unauthenticated second-order SQL-injection vulnerability in the WordPress All-in-One WP Migration and Backup plugin. Attackers can place malicious data that remains dormant until an administrator restores an archive; the resulting SQL execution can expose the ai1wm_secret_key and enable remote code execution.
A high-severity second-order SQL injection flaw in ServMask's All-in-One WP Migration and Backup WordPress plugin. It arises from improper handling of backslashes and escaped quotes while rewriting database content during archive restoration. The flaw may disclose the import secret key and enable a malicious archive import leading to executable code and full site compromise.
Vulnérabilité d’injection SQL de second ordre non authentifiée (CVSS 8,8) dans la fonction replace_table_values() de la classe Ai1wm_Database du plugin All-in-One WP Migration and Backup. Une expression régulière traite incorrectement certaines séquences d’antislashs, permettant à des données de trackback stockées de devenir du SQL exécutable durant une opération d’import. La chaîne décrite permet l’exfiltration de la clé secrète du plugin et une RCE via l’import d’une archive malveillante.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.