Popular WordPress Backup Plugin Had a Site Takeover Bug

A bug in one of the most common WordPress backup plugins could let an attacker take over a site. The catch is that the owner sets it off, just by doing a normal backup and restore. The plugin is All-in-One WP Migration and Backup. The fix is in version 7.110.

Background: our plain guide to SSL.

The flaw was made public on September 2. It is tracked as CVE-2026-19949.

How the Attack Works

This is a two step attack. Security writers call it a second order SQL injection.

1. An attacker posts crafted trackbacks to a public post on the site. Nothing happens yet.
2. Later, the owner exports the site with the plugin and then imports or restores it. That is when the hidden code runs.

The attack can reveal the plugin's secret import key. With that key, an attacker can import a harmful site archive. That can lead to running code on the server and taking over the whole site.

Who Found It and When

BleepingComputer reported that researcher Jack Taylor found the flaw through the Wordfence bug bounty program. It was reported to the plugin maker, ServMask, on August 15. The fix shipped August 20, and the details went public on September 2.

SecurityWeek rated the flaw 8.8 on the common CVSS scale. Both outlets reported that more than 3 million sites were still on a vulnerable version in early September.

Why Owners Should Care

Backup and migration plugins are everywhere on small business sites. People use them when they switch hosts, test a redesign or recover from a mistake. A restore is a routine job, which makes this bug easy to trigger by accident.

What to Do Now

• Check the plugin version under Plugins in your WordPress dashboard.
• Update to version 7.110 or later before you restore any backup.
• If you do not use the plugin anymore, remove it.
• Ask your host whether they keep their own server backups, so you are not relying on a single plugin.