CVE-2026-19949: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in servmask All-in-One WP Migration and Backup
Description
The All-in-One WP Migration and Backup plugin for WordPress contains an SQL Injection vulnerability in its archive restore functionality affecting all versions up to and including 7.109. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and lack of proper query preparation. Exploitation can lead to extraction of sensitive data such as the ai1wm_secret_key and potentially remote code execution when the site administrator performs an archive restore.
CVSS v3.1
Score 8.8high
Affected software
servmask
All-in-One WP Migration and Backup
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19949 is an SQL Injection vulnerability (CWE-89) in the All-in-One WP Migration and Backup WordPress plugin. The vulnerability exists in the archive restore feature in all versions up to 7.109, caused by improper neutralization of special elements in SQL commands. This allows unauthenticated attackers to append malicious SQL queries to existing ones, enabling extraction of sensitive information like the ai1wm_secret_key. With this key, attackers may achieve remote code execution during an archive restore operation performed by an administrator.
Potential Impact
Successful exploitation can lead to disclosure of sensitive database information, including the ai1wm_secret_key, and potentially remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system. The vulnerability requires no user interaction but does require the attacker to trigger the archive restore functionality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the archive restore functionality to trusted administrators only and monitor for suspicious activity during restore operations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-15T20:05:50.105Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8d820aacd9273b492253ac
Added to database: 08/25/2026, 11:52:42 UTC
Last enriched: 09/10/2026, 06:07:23 UTC
Last updated: 10/09/2026, 18:48:18 UTC
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.