How can I tell if my WordPress site was compromised via CVE-2026-19949?

There are no obvious visual signs of compromise via a second-order SQL injection. Indicators include: unfamiliar administrator accounts, unexplained file changes, new redirects, or suspicious entries in the trackback log. Run Wordfence or a similar security scanner — it checks files for modifications and injected code. The primary action is to update the plugin to version 7.110 immediately.

Does exploiting CVE-2026-19949 require authentication?

No. The vulnerability is exploitable without any authentication. The attacker only needs access to WordPress's trackback mechanism, which is enabled by default on most sites. No admin credentials are required. This is what makes the flaw especially dangerous: the barrier to exploitation is extremely low while the potential victim pool exceeds 5 million sites.

Can a VPN protect me as a visitor to a compromised WordPress site?

A VPN does not prevent the site itself from being compromised — that is the responsibility of the site administrator. However, LiMP VPN protects your traffic at the network layer: if a compromised site has injected a JavaScript keylogger and the captured data is transmitted over an insecure channel, the VPN encrypts your connection and shields your traffic from network-level interception (router, ISP, public Wi-Fi). Against server-side compromise, the best defences are unique passwords and two-factor authentication.

← All news

September 3, 2026

5 Million WordPress Sites at Risk: SQL Injection in Backup Plugin

Emily ParkerContent & SEO Specialist

5 Million WordPress Sites at Risk: SQL Injection in Backup Plugin

In short: A critical SQL injection vulnerability (CVE-2026-19949, CVSS 8.8) has been discovered in the All-in-One WP Migration and Backup plugin for WordPress. All versions up to and including 7.109 are affected — over 5 million active sites. The patch was released on August 20, 2026 (version 7.110), but as of early September only about 35% of site owners have updated: approximately 3.25 million sites remain exposed to site takeover and user data theft.

What Happened

On September 3, 2026, Anti-Malware.ru reported a critical vulnerability in All-in-One WP Migration and Backup — one of the most widely installed WordPress plugins, developed by ServMask. The plugin is active on more than 5 million websites and is used to migrate and back up WordPress installations between servers.

CVE-2026-19949 received a CVSS score of 8.8 — classified as critical. Wordfence researchers identified the flaw on August 14 and reported it to the developer. ServMask released the fix in version 7.110 six days later, on August 20, 2026. By early September, only around 35% of installations had been updated, leaving approximately 3.25 million sites vulnerable.

How the Attack Works: Second-Order SQL Injection

The vulnerability belongs to a particularly dangerous and hard-to-detect class — a second-order SQL injection. Unlike a standard SQL injection (which executes immediately at injection time), a second-order attack unfolds in two distinct steps:

Planting phase. The attacker sends malicious data through WordPress's trackback mechanism. The payload is stored in the database in a dormant state — no immediate effect is visible. Crucially, no authentication is required: the attacker does not need access to the admin panel.
Detonation phase. When a site administrator performs an export followed by an import using the plugin, the plugin mishandles backslashes and quotation marks during restore — the stored data is transformed into executable SQL queries.
Site takeover. The injected SQL extracts the secret key _ai1wm_secret_key_ — the plugin's internal authorisation token. With this key, the attacker can import any malicious .wpress archive onto the site and gain remote code execution on the server.

The attacker only needs to plant the trackback once, then wait for a legitimate administrator to perform a migration operation and inadvertently trigger the payload.

Why This Threatens Your Personal Data

WordPress powers approximately 40% of all websites on the internet. There is a high probability that your personal data is stored on several WordPress-powered sites — forums, online shops, news portals, appointment services, and corporate portals. Full compromise of any one of them means:

Database theft. Every user's email address, name, physical address, and password hash (sometimes plaintext) becomes accessible to the attacker.
JavaScript keylogger injection. With code execution capability, an attacker can plant a script that silently captures form data in real time — usernames, passwords, and payment card details from every visitor to the site.
Silent redirects. A compromised site may start redirecting visitors to phishing pages without warning. If you regularly trust and visit a resource, the likelihood of being deceived is substantially higher.

The highest risk falls on small and medium-sized sites: large platforms typically have strict patch policies in place. Small businesses and independent bloggers are far more likely to delay plugin updates — and they make up the bulk of the 3.25 million unpatched installations. For tips on checking whether your data has already been exposed in previous breaches, visit our LiMP VPN security blog.

Who Is at Risk

All WordPress sites running All-in-One WP Migration and Backup versions 7.109 and below are affected. Wordfence is already tracking active scanning for vulnerable installations: attackers are probing sites to identify unpatched copies before administrators have a chance to update.

In scale of affected sites, this vulnerability is comparable to the most significant WordPress ecosystem incidents of recent years. One important note: running HTTPS on your site does not protect against a server-side SQL injection — transport encryption and database security operate at completely separate layers.

How to Protect Yourself: Steps for Site Owners and Users

If you own a WordPress site:

Update All-in-One WP Migration and Backup to version 7.110 or later immediately (Dashboard → Plugins → Updates).
Review your comments and trackback log for entries containing unusual characters — backslashes, unclosed quotation marks, or SQL fragments.
Disable the trackback mechanism if you do not use it (Settings → Discussion → Allow link notifications).
Audit your admin user list: any unrecognised administrator accounts may indicate a prior compromise.

If you are a visitor to WordPress-powered sites:

Use a unique password on every site — a password manager (Bitwarden, KeePass, 1Password) makes this effortless.
Enable two-factor authentication wherever available: even if a password is stolen from a database, login without the second factor remains blocked.
Use LiMP VPN on public Wi-Fi networks: traffic encryption prevents network-level interception even if a compromised site has injected a keylogger that transmits captured data over an unencrypted channel.
Stay current with our security blog: we publish actionable guidance on the day new threats emerge.

Sources

← All news