CVE-2026-19949

Executive Summary

CVE-2026-19949 is an unauthenticated SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress, affecting all versions up to and including 7.109. The flaw exists in the archive restore functionality, where insufficient escaping of a user-supplied parameter and lack of prepared statements on the existing SQL query allows attackers to append additional SQL queries. Successful exploitation enables extraction of sensitive database information, including the ai1wm_secret_key, which can subsequently be leveraged to achieve remote code execution when a site administrator performs an archive restore. With a CVSS score of 8.8, this vulnerability poses a critical risk to the estimated millions of WordPress sites running this popular migration plugin.

Technical Analysis

The All-in-One WP Migration and Backup plugin is one of the most widely deployed WordPress migration tools, with over 5 million active installs historically. The vulnerability resides in the plugin's archive restore functionality, a core feature that allows site administrators to upload backup archives and restore their WordPress installation from a previously saved state.

The root cause of the vulnerability is twofold, as described in the NVD entry:

1. Insufficient escaping on a user-supplied parameter — the plugin fails to properly sanitize or escape input received from the user before incorporating it into a SQL query.
2. Lack of sufficient preparation on the existing SQL query — the plugin constructs the SQL query without using parameterized queries (prepared statements), instead concatenating or interpolating user input directly into the SQL statement.

These two deficiencies combined create a classic SQL injection vulnerability (CWE-89). The attack vector is the archive restore process, which processes data supplied by the client. Because the parameter is not properly escaped and the query is not prepared, an attacker can inject additional SQL statements that get appended to the existing query being executed by the plugin.

The vulnerability is particularly severe because:

• Authentication requirement is minimal: The CVSS vector shows PR:L (low privileges), meaning the attacker requires only low-privileged access to the WordPress instance — such as a subscriber-level account. However, the impact of the injection (C:H/I:H/A:H — high confidentiality, integrity, and availability impact) is significant.
• The attack surface is exposed: Archive restore is a functionality that interacts directly with user-supplied data, making it a natural target for injection attacks.
• Chainable to RCE: The NVD description explicitly details that extracting the ai1wm_secret_key from the database can lead to remote code execution. The ai1wm_secret_key is a plugin-specific secret used for authentication and authorization in various plugin operations — if an attacker obtains this value, they can impersonate the plugin's trusted internal processes, potentially uploading malicious content as part of an archive restore operation.

Technical detail limitation: The NVD description does not disclose the specific SQL query structure, the exact parameter name, or the precise code location within the plugin. Per accuracy requirements, this report will not speculate on these implementation specifics. The vulnerability mechanism is characterized at the class level as a classic SQL injection in the archive restore flow.

Exploitation Scenarios

No public proof-of-concept or exploit code has been identified at the time of writing. The attack chain below is inferred from the vulnerability class and the NVD description.

Scenario 1: Credentialed Low-Privilege Attacker Achieving Full Site Compromise

1. Reconnaissance/target identification: An attacker identifies WordPress sites running the All-in-One WP Migration plugin by fingerprinting the site. This can be done via Shodan dorks (e.g., searching for WordPress sites with the plugin's distinctive HTML markers, CSS files, or JavaScript assets), by examining the site's page source for plugin-specific strings, or by querying public WordPress plugin repositories for install counts. The ai1wm prefix in the plugin's assets is a reliable fingerprint.

2. Triggering the flaw: The attacker authenticates with low-privilege credentials (e.g., a subscriber account, which is the minimum privilege level per the CVSS vector PR:L). They then access the archive restore functionality exposed to this user. During the restore process, an HTTP request is sent to the plugin's restore endpoint carrying the malicious payload in the vulnerable parameter. The exact parameter name is not disclosed in the NVD description; at the class level, the attacker injects SQL syntax (e.g., single quote ', UNION SELECT, OR 1=1 payloads) into the user-supplied field that is processed during archive restoration.

3. Payload/execution method: The attacker appends SQL statements to the existing query to extract data from the WordPress database. The NVD description specifically highlights that the database contains the ai1wm_secret_key value for the plugin. A typical injection at the class level would involve UNION SELECT to retrieve this secret from its storage table, or AND 1=1 / time-based boolean logic to infer values character-by-character. The lack of prepared statements means the injected SQL is executed with the same database privileges as the existing query — typically the WordPress database user, which has full read/write access to the WordPress database.

4. Post-exploitation impact: Once the attacker obtains the ai1wm_secret_key, they can impersonate the plugin's trusted internal operations. Per the NVD description, this enables "remote code execution once able to leverage the ai1wm_secret_key value." The attacker can craft a malicious archive containing PHP code (a web shell) and, using the stolen secret key to pass the plugin's integrity/authentication checks, upload this archive via the restore functionality. When the site administrator performs a legitimate archive restore, the malicious payload gets written to the filesystem within the WordPress installation. This results in full remote code execution on the WordPress server — the attacker can then upload additional webshells, install backdoors, pivot to other systems on the same network, and maintain persistent access.

Scenario 2: Unauthenticated Attack via Social Engineering

While the CVSS vector indicates a low-privilege requirement, the plugin may expose certain restore endpoints to unauthenticated users under specific configurations (e.g., a misconfigured cron job, or a publicly accessible restore endpoint). In such cases, the attacker skips the authentication step entirely. The attack chain otherwise follows the same path: SQL injection to extract ai1wm_secret_key, followed by crafted archive upload and RCE when an administrator next restores the site.

Current Status: No public PoC available; attack chain is inferred from vulnerability class and the NVD description. The vulnerability is UNPATCHED, making all affected installations currently exploitable if the described conditions are met.

Impact Assessment

The CVSS score of 8.8 (High) reflects the severity of this vulnerability. Breaking down the vector:

• AV:N (Network) — The vulnerability is exploitable remotely over the network without requiring physical or local access.
• AC:L (Low) — No special conditions are needed to exploit the flaw; the attack complexity is low.
• PR:L (Low) — The attacker requires low-privileged access, meaning only an authenticated subscriber account (or potentially no account if configuration allows unauthenticated exposure). This is a relatively low barrier to entry.
• UI:N (None) — No user interaction is required to trigger the SQL injection itself.
• Impact (C:H/I:H/A:H) — The vulnerability has high impact across all three CIA dimensions: full confidentiality breach (database contents including secrets and user data), full integrity compromise (ability to modify database and filesystem via subsequent RCE), and high availability impact (potential for data destruction or site defacement).

Business Impact:

• Data Breach: The database contains all WordPress user credentials (hashed but potentially crackable), user PII, transactional data if e-commerce plugins are installed, and the plugin's ai1wm_secret_key.
• Complete Site Takeover: Obtaining ai1wm_secret_key leads directly to remote code execution, granting full control of the web server.
• Lateral Movement: A compromised WordPress server often shares a network with other corporate infrastructure; the attacker can pivot to internal systems.
• Supply Chain Impact: If the compromised site is used to distribute software updates or content (e.g., a plugin/theme distribution platform), the compromise can be weaponized to deliver malware to end-users.

Affected Systems: All WordPress installations running All-in-One WP Migration and Backup plugin version 7.109 or earlier. This encompasses millions of sites, from personal blogs to enterprise and government sites, given the plugin's popularity. The vulnerability is particularly damaging for organizations relying on WordPress as a primary business platform.

Blast Radius: Given the unpatched status and the simplicity of SQL injection attacks, the blast radius is very large. Exploitation requires only low technical skill once the injection point is understood, and the lack of a patch means defenders have no reliable mitigation short of disabling the plugin entirely or implementing WAF rules.

Detection Guidance

The following detection rules target the vulnerability class and mechanisms described in the NVD entry. Because no public exploit exists yet, these rules are designed to catch likely exploitation patterns: SQL injection syntax in requests to the restore functionality, anomalous SQL query volume, and subsequent post-exploitation behavior (file uploads, new admin users, webshell indicators).

Sigma Rule

title: All-in-One WP Migration Service Vulnerability - SQL Injection Attempt
id: ac1fbe65-7b95-4b74-a0ea-9e5e9f073dd4
status: experimental
description: Detects SQL injection attempts against the WordPress All-in-One WP Migration plugin's archive restore endpoint
author: Valtersit Threat Intelligence
date: 2026/01/01
tags:
    - attack.t1190
    - attack.initial-access
    - cve.2026.19949
    - cwe.89
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs or WAF logs from WordPress installations'
detection:
    selection_uri:
        cs-method: 'POST'
        c-uri|contains:
            - 'restore'
            - 'import'
            - 'replace'
            - 'backup'
    selection_payload:
        c-uri|contains|all:
            - 'sql'
            - '%27'  # URL-encoded single quote
            - 'union'
            - 'select'
            - 'concat'
            - 'delay'
            - 'benchmark'
    selection_statuscode:
        sc-status:
            - '200'
            - '500'
            - '403'
    condition: selection_uri and selection_payload and selection_statuscode
    falsepositives:
        - Legitimate use of the archive restore feature by site administrators
        - Backup files or URL parameters containing the word 'union' or 'select' in benign contexts
    level: high

YARA Rule

rule CVE_2026_19949_AI1WM_SQLI_PAYLOAD
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads targeting the All-in-One WP Migration plugin"
        date = "2026-01-01"
        cve = "CVE-2026-19949"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19949"
    strings:
        $sqli1 = /(\%27|\x27)(\s)*(union|UNION|select|SELECT|concat|CONCAT)/ 
        $sqli2 = /(union|UNION)(\s)*(all|ALL)?(\s)*(select|SELECT)/ 
        $sqli3 = /(concat|CONCAT)(\s*)(\(|\()/ 
        $sqli4 = /(sleep|SLEEP|delay|DELAY|benchmark|BENCHMARK)(\s*)(\()/ 
        $ai1wm_ref = /ai1wm|all-in-one-wp-migration|servmask/i
        $restore_ref = /restore|import|backup/i 
        $quote = {27}  // single quote
        $semicolon = {3b}  // semicolon
    condition:
        uint16(0) == 0x0d0a or filesize > 0KB and
        ( 2 of ($sqli*) ) and 1 of ($ai1wm_ref*) and 1 of ($restore_ref*) 
        and ( $quote or $semicolon )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-19949 - All-in-One WP Migration SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"restore"; nocase; pcre:"/(union.*select|concat.*\(|sleep\s*\(|benchmark\s*\()/i"; classtype:attempted-admin; sid:202619949; rev:1; reference:cve,2026-19949; priority:1;)

Elastic Detection

// EQL query for Elastic SIEM
sequence by host.name, source.ip with maxspan=5m
  [ network where
      event.category == "network" and
      network.protocol == "http" and
      http.request.method == "POST" and
      http.request.body.content like~ "*restore*" and
      ( http.request.body.content like~ "*union*select*" or
        http.request.body.content like~ "*concat*" or
        http.request.body.content like~ "*sleep*(*" or
        http.request.body.content like~ "*benchmark*(*" or
        http.request.body.content like~ "*'*" )
  ]
  [ file where
      event.category == "file" and
      file.extension in ("php", "php3", "php4", "php5", "phtml", "pht") and
      ( file.size > 10000 or file.name like~ "*shell*" or file.name like~ "*backdoor*" )
  ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where like(_raw, "%restore%") AND like(_raw, "%POST%")
| rex field=_raw "(?<payload_body>(?<=\r\n\r\n).*)"
| where 
    (like(payload_body, "%union%select%") OR
     like(payload_body, "%UNION%SELECT%") OR
     like(payload_body, "%concat%") OR
     like(payload_body, "%sleep%") OR
     like(payload_body, "%benchmark%") OR
     like(payload_body, "%'%") )
| eval severity = "high"
| table _time, src_ip, dest_host, uri_path, payload_body, severity
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100249" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(php|phtml|php5)</field>
    <field name="url">restore|import|backup</field>
    <field name="data" type="pcre2">(union|UNION).*(select|SELECT)|(concat|CONCAT)\(|(sleep|SLEEP|benchmark|BENCHMARK)\(|%27|(')</field>
    <description>CVE-2026-19949 - Possible SQL Injection on All-in-One WP Migration restore endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,sqli,attack.initial_access</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor (ServMask) has not released a patched version, and no workaround (as formally defined) has been published. Organizations are operating without an official fix.

Immediate Mitigations (no vendor fix available):

1. Disable the plugin immediately if the archive restore feature is not business-critical. The plugin can remain installed (deactivated) without exposing the vulnerable functionality, as the exploit requires the restore functionality to be accessible.
2. Restrict access at the network level: If the plugin must remain active, block external access to the restore endpoints using a Web Application Firewall (WAF) rule. Specifically, block POST requests to the restore/import endpoints that contain SQL injection signatures. ModSecurity with the OWASP CRS ruleset, if tuned properly, can provide partial protection.
3. Enforce least privilege: Ensure no WordPress accounts exist at the subscriber (PR:L) level that can access the restore endpoint. If feasible, lock down all non-admin accounts and use IP whitelisting for admin area access.
4. Monitor database query logs: Enable MySQL/MariaDB query logging and alert on abnormal SELECT statements involving the plugin's option tables where ai1wm_secret_key is stored.
5. Credential rotation: If the site has been exposed for any period, rotate the ai1wm_secret_key (via re-saving plugin settings) and reset WordPress admin passwords, as the secret may have been extracted.

Patch/Upgrade Steps:

• Monitor the official WordPress plugin repository (wordpress.org/plugins/all-in-one-wp-migration/) and the vendor's site (servmask.com) for a patched release (version > 7.109). As of this report date, no patched version exists.
• When a patch is released, test it in a staging environment, then apply it to production. Immediately after patching, rotate the ai1wm_secret_key and all admin account passwords.
• Because the vulnerability is unpatched, consider migrating away from this plugin to an alternative migration/backup plugin (e.g., UpdraftPlus, Duplicator) that uses prepared statements and proper input validation in its restore functionality.

Long-Term Hardening:

• Adopt a WAF: Deploy a Web Application Firewall (e.g., Cloudflare, AWS WAF, ModSecurity) for all WordPress-facing endpoints. Configure rules to block SQL injection signatures at the perimeter.
• Harden the WordPress database user: Create a dedicated MySQL user with minimum necessary privileges (no FILE, SUPER, or PROCESS privileges) and limit it to the WordPress database only. This mitigates the impact of successful injection.
• Regular backup and recovery testing: Maintain verified backups so that if the site is compromised, recovery is rapid.
• Security plugin deployment: Install and configure a WordPress security plugin (Wordfence, Sucuri) with real-time traffic monitoring, file integrity checking, and login attempt limiting.
• Network segmentation: Isolate the WordPress server in a DMZ with no lateral access to internal corporate networks. If RCE occurs, the blast radius is contained.
• Stay current: Enable automatic updates for WordPress core and all plugins, and subscribe to CVE alerts (NVD, WPScan) to receive notifications as soon as patches for this CVE are released.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19949 (Official NIST National Vulnerability Database record)
2. WordPress Plugin Repository: https://wordpress.org/plugins/all-in-one-wp-migration/ (Official plugin page; monitor for version releases and changelog announcements)
3. Vendor Site: https://servmask.com/ (Official vendor page; watch for security advisories and patch announcements)
4. WPScan Vulnerability Database: https://wpscan.com/ (WordPress-specific vulnerability database; check for this plugin's entry and any vendor response)
5. CWE-89 Reference: https://cwe.mitre.org/data/definitions/89.html (SQL Injection class definition and common mitigation strategies)

Threat Actor Intelligence: At the time of writing this report, there are no known active campaigns, exploit-in-the-wild evidence, or threat actor group attributions associated with CVE-2026-19949. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the unpatched status and the popularity of the plugin, this is a high-value target for both opportunistic attackers (via mass scanning with Shodan or Censys) and targeted campaigns against high-profile WordPress sites. Historical precedent from similar SQL injection vulnerabilities in WordPress migration plugins indicates that weaponized exploits typically appear within weeks of public disclosure. Security teams should treat this as an actively exploitable zero-day risk until a patch is released.