#SQL Injection

Second-Order SQL Injection in All-in-One WP Migration Leaves Millions of WordPress Sites Open to RCE

A high-severity flaw tracked as CVE-2026-19949 affects the All-in-One WP Migration and Backup plugin by ServMask, an extension deployed on over 5 million active WordPress installations. Assigned a CVSS score of 8.8, the bug is a second-order SQL injection vulnerability residing inside the plugin's `.wpress` archive restoration workflow. When administrators restore or migrate an environment, the plugin modifies SQL dumps to adjust source URLs and table prefixes via its `replace_table_values()` function. The parsing logic relies on a regular expression designed to locate quoted SQL strings, but it inspects only the single character preceding a quote rather than parsing full preceding backslash sequences. Because trailing backslashes are mishandled, string boundaries break during the unescaping, substitution, and re-escaping pipeline, causing unescaped input to evaluate as raw executable SQL commands. Unauthenticated attackers can plant malicious payloads in advance by submitting crafted trackbacks containing specific trailing backslashes and URLs to public blog posts. WordPress core stores these trackback entries directly inside the database comments table without sanitizing the backslashes or rejecting the malicious payloads. The exploit payload remains dormant until an administrator initiates a standard site backup export and subsequent restore cycle. Once triggered by the restore routine, the injected SQL manipulates the database to expose the plugin's internal `ai1wm_secret_key` inside a publicly approved comment. Attackers can query the public WordPress comments REST API to retrieve the leaked secret key and bypass authentication on the plugin's import endpoint. With this access, attackers can upload a malicious `.wpress` archive bundled with a must-use plugin, triggering immediate PHP code execution on subsequent requests. ServMask patched the flaw in version 7.110 on August 20, 2026, yet telemetry indicates that roughly 3.25 million sites remained unpatched weeks after release.