Over 3 Million WordPress Sites Affected by Migration Plugin

What happened

configured to detect and block common SQL injection patterns directed at WordPress endpoints. Security teams should monitor system logs for unusual database queries or unexpected administrative actions that could indicate an attempted exploitation. Conducting a thorough security scan of the entire database and server filesystem is highly recommended to ensure that no backdoors have already been established. If any suspicious activity is detected, incident response protocols should be activated to isolate the affected server, rotation of all database passwords and API

A high-severity vulnerability in the All-in-One WP Migration and Backup WordPress plugin exposes over 3 million websites to remote code execution (RCE) attacks, WordPress security firm Defiant warns. Tracked as CVE-2026-19949 (CVSS score of 8.8), the security defect is described as a second-order SQL injection issue in the archive restore functionality of the plugin.

How it works

The flaw exists because user-supplied input is insufficiently escaped and existing SQL queries are not sufficiently prepared, Defiant explains. An attacker could supply malicious content via WordPress core’s trackback functionality to extract the secret key used during an archive restore operation, and then use the key to deploy a malicious plugin for RCE.

Why it matters

All-in-One WP Migration and Backup packages sites into .wpress archives and allows admins to restore the archive on any destination server. See the full write-up from SecurityWeek via the source link for quotes and complete context.

Who is affected

Read the original coverage at SecurityWeek via the source link above for the complete details and primary quotes.

What to watch next

Cross-check release notes and official docs before changing production systems based on early reporting.