CVE-2026-19949: All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wmsecretkey when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wmsecretkey value.
Affected Software
Event History
Frequently Asked Questions
Which installations should be considered affected?
ServMask All-in-One WP Migration and Backup installations running version 7.109 or earlier should be considered affected. The provided data does not identify any configuration prerequisite.
Does exploitation require an authenticated WordPress account?
The SQL injection is described as reachable by unauthenticated attackers. However, the remote-code-execution path depends on a site administrator performing an archive restore after the attacker obtains the ai1wm_secret_key.
What makes this issue capable of progressing beyond database disclosure?
Injected SQL can be used to extract the ai1wm_secret_key from the database. The description states that this key can then be leveraged to achieve remote code execution when an administrator performs an archive restore.