#WordPress — insecure by design

high3 sourcesCVE-2026-19949

Second-Order SQL Injection in All-in-One WP Migration Leaves Millions of WordPress Sites Open to RCE

A high-severity flaw tracked as CVE-2026-19949 affects the All-in-One WP Migration and Backup plugin by ServMask, an extension deployed on over 5 million active WordPress installations. Assigned a CVSS score of 8.8, the bug is a second-order SQL injection vulnerability residing inside the plugin's `.wpress` archive restoration workflow. When administrators restore or migrate an environment, the plugin modifies SQL dumps to adjust source URLs and table prefixes via its `replace_table_values()` function. The parsing logic relies on a regular expression designed to locate quoted SQL strings, but it inspects only the single character preceding a quote rather than parsing full preceding backslash sequences. Because trailing backslashes are mishandled, string boundaries break during the unescaping, substitution, and re-escaping pipeline, causing unescaped input to evaluate as raw executable SQL commands. Unauthenticated attackers can plant malicious payloads in advance by submitting crafted trackbacks containing specific trailing backslashes and URLs to public blog posts. WordPress core stores these trackback entries directly inside the database comments table without sanitizing the backslashes or rejecting the malicious payloads. The exploit payload remains dormant until an administrator initiates a standard site backup export and subsequent restore cycle. Once triggered by the restore routine, the injected SQL manipulates the database to expose the plugin's internal `ai1wm_secret_key` inside a publicly approved comment. Attackers can query the public WordPress comments REST API to retrieve the leaked secret key and bypass authentication on the plugin's import endpoint. With this access, attackers can upload a malicious `.wpress` archive bundled with a must-use plugin, triggering immediate PHP code execution on subsequent requests. ServMask patched the flaw in version 7.110 on August 20, 2026, yet telemetry indicates that roughly 3.25 million sites remained unpatched weeks after release.

Critical Exploit Chain in Avada Theme and Fusion Builder Unlocks Unauthenticated RCE

A critical vulnerability tracked as CVE-2026-18431 with a 9.8 CVSS score enables unauthenticated remote code execution on WordPress instances running the Avada theme. The exploit ties together six distinct flaws spanning authorization, input validation, trust-boundary, and file-handling weaknesses into a zero-click attack path. Successful exploitation allows an attacker to execute arbitrary PHP code directly on the target host. This level of access enables complete site takeover, database exfiltration, malware deployment, malicious redirects, and the creation of rogue administrator accounts. The vulnerability impacts Avada versions up to 7.16 alongside Fusion Builder plugin versions up to 3.16. While both components are strictly required to trigger the full exploit chain, Fusion Builder is a mandatory plugin bundled with the Avada theme. Consequently, all sites using the Avada theme ship with the necessary dependencies and remain vulnerable. Defiant's Wordfence team discovered and reproduced the issue using an automated agentic framework named Argus, which also developed functional proof-of-concept exploit code. ThemeFusion resolved the flaws by issuing patches in Avada version 7.16.1 and Fusion Builder version 3.16.1. Full technical details are currently withheld by researchers to allow system administrators time to apply the updates.

Active Exploitation Targets Critical miniOrange SAML Flaws in WordPress

Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, tracked as CVE-2026-61979 and CVE-2026-15981, are being actively targeted in the wild. The flaws stem from signature algorithm confusion and improper handling of OpenSSL verification errors, allowing unauthenticated attackers to forge SAML assertions and acquire administrator session cookies. Because the vendor distributes multiple commercial editions under a shared plugin slug, many paid installations fail to show update alerts within the WordPress dashboard and require manual upgrades.