CVE-2026-19949 — servmask All-in-One WP Migration and Backup

What is CVE-2026-19949?

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.

The record classifies CVE-2026-19949 under weakness class CWE-89. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 41 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 8.8 — HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (FIRST): 0.5% probability of exploitation in the next 30 days, higher than 43.2% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 6.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-08-25, last modified 2026-08-27

Is CVE-2026-19949 being exploited?

No public exploitation evidence for CVE-2026-19949 is recorded in the sources Threadlinqs tracks — CISA KEV, Exploit-DB, public proof-of-concept repositories and ProjectDiscovery Nuclei — as of 2026-08-27. That is an absence of evidence in those feeds, not a guarantee that the vulnerability is unexploited.

Affected products and versions

servmask: All-in-One WP Migration and Backup

How to fix CVE-2026-19949

No vendor patch reference has been recorded for CVE-2026-19949 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-19949

1 tracked threat in the Threadlinqs corpus references CVE-2026-19949, either in the campaign’s CVE list or as an indicator on the campaign record.

Second-Order SQL Injection in All-in-One WP Migration and Backup Plugin (CVE-2026-19949) Exposes 5M+ WordPress Sites to Takeover — HIGH · 2026-09-02

Sources

Enriched from CVE.org, NVD, FIRST EPSS. Last verified by Threadlinqs on 2026-09-03. This product uses the NVD API but is not endorsed or certified by the NVD.

Other references

Showing 5 of 8 recorded references.