EUVD-2026-65463
GHSA-wgw6-99h6-924c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess plugin restore endpoint
-
DeliveryInject SQL via unsanitized parameter
-
ExploitExtract ai1wm_secret_key from wp_options table
-
ExecutionAuthenticate to plugin restore API using secret key
-
PersistUpload malicious archive payload
-
ImpactExecute arbitrary code on WordPress server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The SQL injection is triggered through user-supplied parameters processed during an archive restore operation using the All-in-One WP Migration and Backup plugin. The description states the injection can be performed by unauthenticated attackers, but the provided CVSS vector specifies PR:L (low privileges) - this conflict is unresolved and authentication requirements must be verified against the Wordfence advisory before drawing firm conclusions. The description further conditions the ai1wm_secret_key extraction on 'when a site administrator performs an archive restore,' implying the first-stage SQL injection may require an admin to initiate or be actively mid-process in a restore operation; however the CVSS vector specifies UI:N, suggesting the attacker may independently trigger the vulnerable code path. No non-default configuration appears required beyond the plugin being installed and active at version 7.109 or earlier. Exploitation for full RCE is a two-stage process: successful SQLi and key extraction are prerequisites before the secret key can be leveraged for code execution. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, score 8.8) contains an internal conflict with the vulnerability description: the description explicitly states 'unauthenticated attackers' can exploit the flaw - corresponding to PR:N - while the vector specifies PR:L (low privileges). Additionally, the description states that extracting the ai1wm_secret_key occurs 'when a site administrator performs an archive restore,' implying a conditional dependency that could map to UI:R or AC:H rather than the UI:N/AC:L in the provided vector. These discrepancies should be verified with Wordfence or the vendor before using this score to drive patch SLA decisions. No KEV listing indicates confirmed widespread mass exploitation has not been observed; no EPSS data was provided to estimate exploitation probability. Despite these signal ambiguities, the two-stage RCE chain - SQLi to secret key to authenticated plugin API abuse - significantly elevates operational risk beyond what the raw CVSS alone conveys, warranting urgent patching regardless of vector interpretation. |
| Exploit ScenarioDerived | An attacker with network access submits crafted SQL payloads through the archive restore endpoint, injecting additional SQL into the insufficiently parameterized queries in the database import layer to extract the ai1wm_secret_key from the WordPress wp_options table. With the secret key in hand, the attacker authenticates to the plugin's restore API and supplies a malicious archive file, achieving remote code execution on the WordPress server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
SQL injection in the All-in-One WP Migration and Backup plugin (servmask, versions through 7.109) enables a two-stage attack path culminating in remote code execution. Insufficient parameterization in the archive restore database layer allows attackers to append arbitrary SQL queries and exfiltrate the ai1wm_secret_key from the WordPress database; once obtained, this key unlocks the plugin's restore endpoint and enables RCE. No KEV listing or EPSS data is available at time of analysis, but the direct RCE chaining potential makes this a high-priority remediation target for any WordPress site running the affected plugin.
RemediationAI
Update the All-in-One WP Migration and Backup plugin immediately to a version beyond 7.109. A code changeset (revision 3656677) is visible on the WordPress plugin trac repository at https://plugins.trac.wordpress.org/changeset?reponame=&old=3656677%40all-in-one-wp-migration&new=3656677%40all-in-one-wp-migration, indicating an upstream fix has been committed; however, a specific patched release version number is not independently confirmed from the available reference data - verify the current plugin version in the WordPress repository before updating. Until the patch is applied, administrators should disable archive import and restore functionality if not operationally required; this reduces the attack surface at the cost of losing backup restore capability. Restricting access to the plugin's import controller endpoints via WAF rules targeting the restore workflow is an additional compensating control. As a precautionary measure, rotating the ai1wm_secret_key value stored in the WordPress options table is advisable if restore operations have been performed recently on an internet-exposed site.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the database abstraction layer of the servmask All-in-One WP Migration and Backup plugin (CPE: cpe:2.3:a:servmask:all-in-one_wp_migration_and_backup:*:*:*:*:*:*:*:*). CWE-89 (Improper Neutralization of Special Elements in an SQL Command) applies: user-supplied parameters passed during archive import and restore operations are not adequately escaped or prepared before inclusion in existing SQL queries. The vulnerable code spans multiple locations in class-ai1wm-database.php (lines 1250, 1637, and 1726) and class-ai1wm-import-database.php (line 1065), invoked through the main controller (class-ai1wm-main-controller.php:1336) and import controller (class-ai1wm-import-controller.php:68). The ai1wm_secret_key is a WordPress option stored in the wp_options table that authenticates plugin API calls, making its extraction via blind or union-based SQL injection a critical pivot to RCE.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:N per description's 'unauthenticated attackers'; AC:H and UI:R because key extraction is conditioned on an admin actively performing a restore, adding an exploitation precondition.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.
Executive ViewAI
WordPress sites using the All-in-One WP Migration and Backup plugin (through version 7.109) face critical risk from a SQL injection vulnerability (CVE-2026-19949) that can lead to complete server compromise. This affects any organization storing sensitive data in WordPress databases and relying on this plugin. No vendor-released patch has been identified at time of analysis, making immediate mitigation essential.
Until a vendor patch is released: restrict access to the plugin's restore functionality to authenticated administrators only with IP-based allowlisting and VPN requirement; disable the plugin entirely if backup restoration is not immediately required; implement database activity monitoring to detect unauthorized SQL queries; enforce multi-factor authentication for all WordPress administrator accounts; and maintain offline backup copies independent of the plugin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB