Filtered by category: WordFence, tag: second-order injection × Clear
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Matched: WordPress
A critical SQL injection flaw (CVE-2026-19949, CVSS 8.8) was found in the All-in-One WP Migration and Backup WordPress plugin, affecting over 5 million sites. Unauthenticated attackers can plant malicious trackbacks that execute as SQL when an admin performs a backup restore, leaking a secret key and enabling remote code execution. Users should update to version 7.110 immediately. Wordfence Premium users received firewall protection August 16; free users get it September 15.