THREATOPS

THREAT OPS › Threat News › 5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

medwordfencePublished 2026-09-01

<p>On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in <a href="https://wordpress.org/plugins/all-in-one-wp-migration/" rel="noopener" target="_blank">All-in-One WP Migration and Backup</a>, a WordPress plugin with more than 5 million active installations. This vulnerability makes it possible for unauthenticated attackers to inject SQL

MITRE ATT&CK techniques

VulnerabilitiesT1588.006

Indicators of compromise

cd164c6348ca2048a891d26c4106e94amd5
CVE-2026-19949cve
https://wordpress.org/plugins/all-in-one-wp-migration/url
https://www.cve.org/CVERecord?id=CVE-2026-19949url
www.gravatar.comdomain

Original source: https://www.wordfence.com/blog/2026/09/5-million-wordpress-sites-affected-by-sql-injection-vulnerability-in-all-in-one-wp-migration-and-backup-wordpress-plugin/