Millions of WordPress Sites Still Vulnerable: What CVE-2026-19949 Means for You

If your site runs the All-in-One WP Migration and Backup plugin, stop and check the version now. There's a serious hole in it, tracked as CVE-2026-19949, and as of 2 September an estimated 3.25 million sites were still running versions that hadn't been patched. The fix already exists. You just need to install it.

The irony isn't lost on us. This is a backup tool, the thing you install so you can recover when something goes wrong. But an unpatched copy can become the very thing that lets an attacker take your site over.

Key takeaways

• CVE-2026-19949 is a high-severity SQL injection flaw in All-in-One WP Migration and Backup, affecting version 7.109 and earlier.
• It was patched in version 7.110, so updating is the whole fix.
• The plugin has more than 5 million active installations, and around 3.25 million sites were still vulnerable as of 2 September (though not every install is necessarily affected).
• Under the right conditions the bug can leak the plugin's secret key, which researchers say can open a path to remote code execution and full site takeover.
• While you're in there, audit every plugin on the site. Outdated ones are usually the weakest link.

What actually happened

Researcher Jack Taylor found the flaw and reported it to Wordfence through its bug bounty programme on 14 August. Wordfence then alerted ServMask, the developer behind the plugin, and described it as a second-order SQL injection.

The short version: an attacker can plant malicious input in your database first, then wait. Nothing happens straight away. The danger only kicks in when the plugin later does its job, exporting or restoring an archive, and pulls that stored input into a database query without properly cleaning it.

That delay is the whole point. The malicious data sits there quietly until a legitimate action triggers it. And the action that triggers it is exactly what you'd expect an admin to do with a backup plugin: run a backup or a restore.

Why this one is worse than a normal SQL injection

Regular SQL injection is bad enough. It lets an attacker read information out of your database that they shouldn't be able to see.

With CVE-2026-19949, one of the things that can be exposed is the plugin's secret key. Researchers found that key can provide a path toward remote code execution, which is the point where an attacker can start running their own code on your server and take control of the site.

So the risk isn't just "someone reads your database". It's that the attack can be set up in advance and then fired off by an ordinary administrative action you were always going to perform anyway. That combination, planted early and triggered by trusted behaviour, is what makes it genuinely nasty.

One thing worth keeping in perspective: the plugin has more than 5 million active installations, but that doesn't mean all of them are vulnerable, according to BleepingComputer's 2 September report. The 3.25 million figure is the count that was still running affected versions.

Why plugins with high privileges keep getting targeted

There's a pattern here, and it's getting hard to ignore. Plugins that handle backups, user registration, page building and other admin jobs need deep access to sensitive parts of a WordPress install. That access is exactly what makes a flaw in them so valuable.

When a plugin can touch your database, your user accounts and your core site functions, a single mistake in its code can hand all of that to an attacker. A convenience feature turns into a front door.

We've seen it repeatedly this year. In March, a flaw in the User Registration & Membership plugin let attackers create admin accounts on WordPress sites. The same month, a flaw in the Elementor Ally plugin exposed over 400,000 sites to data theft. Different plugins, same lesson: the more control a plugin gives an admin, the more damage a bug in it can do.

If you want the wider picture on how these alerts stack up, we covered two more takeover-class bugs in a full takeover bug and 12 core fixes.

What to do right now

Here's the order to work through.

1. Update All-in-One WP Migration and Backup to version 7.110. This is the patched release and it's the entire fix for CVE-2026-19949. Go to Plugins in your WordPress dashboard, find the plugin, and update it. If you're not sure what version you're on, check it before assuming you're safe.
2. Audit every plugin on the site. A plugin can be quietly doing something useful in the background and still be your biggest liability if it's out of date.
3. Delete plugins you don't use. An inactive plugin still sitting on the server is still code that can be attacked. If it's not earning its place, remove it.
4. Keep the rest updated as security fixes land. WordPress lets you turn on auto-updates for plugins. If you're the sort who tends to skip the manual check, auto-updates are probably the safer default for you.

The immediate priority is simple, though. If this plugin is installed, make sure it isn't running an affected version. Everything else can follow.

The bigger point for busy site owners

Most small businesses don't have someone whose job is to watch WordPress security feeds. So a flaw like this sits unpatched for weeks, not because anyone decided to ignore it, but because nobody was looking. That's how 3.25 million sites end up exposed to something that already had a fix.

This is the whole case for a proper website maintenance plan: updates get applied quickly, plugins get reviewed, and you're not relying on remembering to log in and check. If you'd rather handle plugins and backups on your own terms, our team also builds and hardens sites through WordPress development so the foundation is solid before anything gets bolted on.

Backup tools are meant to be your safety net. Keep them patched, and they stay one. Leave them alone, and they can become the hole in the floor.

Want someone to keep your WordPress site updated and watched so bugs like CVE-2026-19949 get patched before they matter? Talk to us about ongoing website maintenance.