Second-Order SQL Injection in All-in-One WP Migration Leaves Millions of WordPress Sites Open to RCE
A high-severity flaw tracked as CVE-2026-19949 affects the All-in-One WP Migration and Backup plugin by ServMask, an extension deployed on over 5 million active WordPress installations. Assigned a CVSS score of 8.8, the bug is a second-order SQL injection vulnerability residing inside the plugin's `.wpress` archive restoration workflow. When administrators restore or migrate an environment, the plugin modifies SQL dumps to adjust source URLs and table prefixes via its `replace_table_values()` function. The parsing logic relies on a regular expression designed to locate quoted SQL strings, but it inspects only the single character preceding a quote rather than parsing full preceding backslash sequences. Because trailing backslashes are mishandled, string boundaries break during the unescaping, substitution, and re-escaping pipeline, causing unescaped input to evaluate as raw executable SQL commands. Unauthenticated attackers can plant malicious payloads in advance by submitting crafted trackbacks containing specific trailing backslashes and URLs to public blog posts. WordPress core stores these trackback entries directly inside the database comments table without sanitizing the backslashes or rejecting the malicious payloads. The exploit payload remains dormant until an administrator initiates a standard site backup export and subsequent restore cycle. Once triggered by the restore routine, the injected SQL manipulates the database to expose the plugin's internal `ai1wm_secret_key` inside a publicly approved comment. Attackers can query the public WordPress comments REST API to retrieve the leaked secret key and bypass authentication on the plugin's import endpoint. With this access, attackers can upload a malicious `.wpress` archive bundled with a must-use plugin, triggering immediate PHP code execution on subsequent requests. ServMask patched the flaw in version 7.110 on August 20, 2026, yet telemetry indicates that roughly 3.25 million sites remained unpatched weeks after release.
Commentary
Second-order SQL injection bugs that trigger only during administrative maintenance workflows are a fascinating edge case, often slipping past standard web application firewalls because the initial injection vector—here, regular trackbacks—looks harmless to generic inspection filters. What makes this vulnerability particularly insidious is the full exploit chain: it turns dormant, unauthenticated blog trackbacks into an information disclosure primitive, exfiltrates an internal key via the public REST API, and completes the loop by abusing the plugin's built-in migration handler to drop a must-use (`mu-plugins`) web shell for unauthenticated Remote Code Execution. Organizations running WordPress must immediately audit their plugins and update All-in-One WP Migration to version 7.110 or later. Beyond merely patching the plugin, defenders should completely disable legacy XML-RPC pingbacks and trackbacks across all public post types if they are not strictly needed, as these mechanisms remain a persistent low-friction vector for malicious data insertion. Incident response teams should also review `wp_comments` for anomalous trackback entries containing odd backslash escaping, inspect the comments REST API logs for mass querying, and audit the `wp-content/mu-plugins/` directory for any unexpected PHP files introduced during recent migration activities.
The Quote to Remember
“The vulnerable replace_table_values() function relies on a regular expression intended to identify quoted SQL strings. However, this expression checks only the character immediately before a closing quotation mark rather than evaluating the entire sequence of preceding backslashes.”
“Since backup and restore is the core purpose of this plugin, this is a routine action, but the injected SQL will not execute until it takes place”