Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
SQL injection vulnerability in WordPress plugin affects over 3 million sites.
Run Defiant?
Get an email when a reviewed story names Defiant, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical SQL injection vulnerability (CVE-2026-19949) in the All-in-One WP Migration and Backup plugin could allow unauthenticated attackers to achieve remote code execution on over 3 million WordPress sites. The flaw enables attackers to extract a secret key used for archive restores, which can then be used to deploy a malicious plugin. While a patch was released in version 7.110, only 35% of affected sites have updated.
The lesson from this incident
Full lessonA critical SQL injection vulnerability in the All-in-One WP Migration and Backup plugin allows unauthenticated attackers to extract a secret key and achieve remote code execution — one of the most severe attack chains possible. Despite a patch being available in version 7.110, nearly two-thirds of affected sites remain unpatched, exposing millions of organizations to full site compromise. This highlights a persistent and dangerous gap between vulnerability disclosure and real-world patch adoption. The consequences of exploitation include data theft, ransomware deployment, and complete takeover of affected WordPress environments, making timely patching non-negotiable.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-19949