An unauthenticated attacker can leave two rigged trackbacks on a WordPress post and then do nothing at all. The payload sits inert in the comments table until the site owner performs an entirely routine piece of housekeeping: backing the site up and restoring it. That restore is the moment the attacker takes the site.
Wordfence disclosed the flaw, tracked as CVE-2026-19949 and rated 8.8 on the CVSS scale, in All-in-One WP Migration and Backup, a plugin with more than 5 million active installations. Every version up to and including 7.109 is affected. ServMask, the plugin's developer, shipped the fix in version 7.110 on August 20, 2026.
A payload that waits for the admin
This is a second-order SQL injection, which means the malicious input is stored during one action and only becomes dangerous when something else processes it later. The planting is done through WordPress core's trackback feature, which needs no login. An attacker sends two trackbacks to a public post that accepts pings, with a blog name that ends in a trailing backslash and a URL carrying the payload. WordPress core files both away in the comments table as the comment author and the author URL, backslash intact.
A regular expression that miscounts backslashes
Nothing happens until an administrator exports the site and imports it again. During import the plugin rewrites old URLs and database table prefixes inside each stored SQL statement, using a regular expression to find quoted string literals. That expression checks only the single byte before a closing quote to decide whether the quote is escaped, rather than counting the whole run of backslashes in front of it. A quote preceded by two backslashes is a real string ending, but the regex reads it as escaped and keeps matching into the next literal. The over-captured value is then unescaped, rewritten and re-escaped, and it comes back out with an unbalanced run of backslashes that moves the MySQL string boundary. The attacker's stored text stops being data and starts being SQL.
The secret key ends up in a public comment
The two planted rows have separate jobs. The first is sized to blow through the import pipeline's time budget, which forces the restore to commit and resume on a later pass, and the plugin restores the site's real ai1wm_secret_key into the options table at each of those pass boundaries. The second row reads that key out of the options table, writes it into a comment, and marks the comment approved. The attacker then simply reads it from the site's public comments REST API endpoint, with no authentication at all.
That key is the only gate on the plugin's import action, which is registered for unauthenticated access. Holding it, the attacker drives the importer directly against a crafted .wpress archive containing a malicious must-use plugin. The file is extracted into the must-use plugins directory and executed on the next page load. That is remote code execution as the web server user, and from there the site is gone.
Update to 7.110 before your next restore
Update the plugin now. The chain does not fire until an export and import cycle happens, so a site sitting on a stale version is not necessarily compromised yet. But backup and restore is precisely what this plugin exists to do, and the trigger is the administrator's own routine work. Wordfence pushed a firewall rule to its Premium, Care and Response customers on August 16, 2026; sites running the free version are scheduled to receive the same rule on September 15, 2026.
The write-up comes from Wordfence's István Márton, who credits researcher Jack Taylor for finding and reporting the bug through the Wordfence Bug Bounty Program. It lands in a heavy season for the ecosystem: Wordfence counted 249 WordPress flaws in a single week last month, and the plugin repository has already resorted to forcing a mass update this year when a bug was bad enough to warrant it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.