# CVE-2026-19949 — servmask All-in-One WP Migration and Backup > As of 2026-08-27, CVE-2026-19949 is a HIGH-severity vulnerability in servmask All-in-One WP Migration and Backup, CVSS v3.1 8.8, EPSS 0.5% (43.2th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-19949, most recently “Second-Order SQL Injection in All-in-One WP Migration and Backup Plugin (CVE-2026-19949) Exposes 5M+ WordPress Sites to Takeover”. **Last updated:** 2026-08-27 ## What is CVE-2026-19949? The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value. The record classifies CVE-2026-19949 under weakness class [CWE-89](https://intel.threadlinqs.com/cwe/CWE-89). Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 41 days ago. ## Severity and exploitation probability - **CVSS v3.1 base score:** 8.8 — HIGH (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`) - **EPSS (FIRST):** 0.5% probability of exploitation in the next 30 days, higher than 43.2% of all scored CVEs - **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog - **Threadlinqs priority:** 6.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability - **Published:** 2026-08-25, last modified 2026-08-27 ## Is CVE-2026-19949 being exploited? No public exploitation evidence for CVE-2026-19949 is recorded in the sources Threadlinqs tracks — CISA KEV, Exploit-DB, public proof-of-concept repositories and ProjectDiscovery Nuclei — as of 2026-08-27. That is an absence of evidence in those feeds, not a guarantee that the vulnerability is unexploited. ## Affected products and versions - **servmask**: All-in-One WP Migration and Backup ## How to fix CVE-2026-19949 No vendor patch reference has been recorded for CVE-2026-19949 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise. ## Threat activity tracking CVE-2026-19949 1 tracked threat in the Threadlinqs corpus references CVE-2026-19949, either in the campaign’s CVE list or as an indicator on the campaign record. - [Second-Order SQL Injection in All-in-One WP Migration and Backup Plugin (CVE-2026-19949) Exposes 5M+ WordPress Sites to Takeover](https://intel.threadlinqs.com/threat/TL-2026-2301) — HIGH · 2026-09-02 ## Sources Enriched from CVE.org, NVD, FIRST EPSS. Last verified by Threadlinqs on 2026-09-03. This product uses the NVD API but is not endorsed or certified by the NVD. **Other references** - [wordfence.com](https://www.wordfence.com/threat-intel/vulnerabilities/id/22e273d9-a268-4dc5-b1f6-3bc5c29232c5?source=cve) - [plugins.trac.wordpress.org](https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1637) - [plugins.trac.wordpress.org (class ai1wm database)](https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1250) - [plugins.trac.wordpress.org (class ai1wm database)](https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1726) - [plugins.trac.wordpress.org (class ai1wm import database)](https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/model/import/class-ai1wm-import-database.php#L1065) _Showing 5 of 8 recorded references._ Canonical: https://intel.threadlinqs.com/cve/CVE-2026-19949 Full detection coverage and IOCs for threats exploiting CVE-2026-19949 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp