CVE-2026-19949 servmask CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and prioritize remediation, as this vulnerability could allow attackers to disclose sensitive information and potentially achieve remote code execution.

Why it matters

CVE-2026-19949 is a SQL Injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress. Site administrators and security teams should assess exposure and prioritize remediation to prevent potential sensitive information disclosure and remote code execution.

• Disclosure of sensitive information such as database credentials or encryption keys.
• Potential for remote code execution if an attacker can leverage the ai1wm_secret_key.
• Increased risk of lateral movement within the network if exploitation occurs.
• Need for verification of plugin version and exposure to the vulnerability.

Technical summary

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Defensive priority

High

Recommended defensive actions

• Immediately update the All-in-One WP Migration and Backup plugin to a version that fixes the SQL Injection vulnerability.
• Restrict access to the archive restore functionality to authenticated and authorized users only.
• Monitor database activity for suspicious queries that could indicate exploitation attempts.
• Consider implementing a Web Application Firewall (WAF) to detect and prevent SQL Injection attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries in the archive restore functionality of the All-in-One WP Migration and Backup plugin. This could allow attackers to extract sensitive information from the database, such as the ai1wm_secret_key, which could be used for remote code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.