{"id":11998,"date":"2026-09-03T14:05:39","date_gmt":"2026-09-03T20:05:39","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-96-sqli-vulnerability-in-all-in-one-wp-migration-and-backup\/"},"modified":"2026-09-29T13:01:39","modified_gmt":"2026-09-29T19:01:39","slug":"alert-2026-96-sqli-vulnerability-in-all-in-one-wp-migration-and-backup","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-96-sqli-vulnerability-in-all-in-one-wp-migration-and-backup\/","title":{"rendered":"Alert 2026-96 SQLi Vulnerability in All-in-One WP Migration and Backup"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
All-in-One WP Migration and Backup for WordPress<\/strong><\/td>All versions up to 7.109, inclusive<\/td>7.110 or later<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Description<\/h2>\n\n

A second-order SQL injection<\/strong> vulnerability was identified in the WordPress plugin All-in-One WP Migration and Backup<\/strong> that can lead to complete takeover of a vulnerable site. The flaw, identified as CVE\u20112026\u201119949<\/strong> and rated CVSS 8.8 (High)<\/strong>, affects all versions up to and including 7.109<\/strong>; the fix is available from version 7.110<\/strong>.<\/p>\n\n

The plugin is widely used to export, import, restore, and migrate WordPress sites through .wpress files, which can include application files and database content.<\/p>\n\n

CVE\u20112026\u201119949 is an SQL Injection<\/strong> vulnerability classified as CWE\u201189 in the plugin’s file restoration functionality. The issue is due to insufficient escaping of user-controlled parameters and the lack of secure preparation of existing SQL queries when the plugin processes and rewrites database content during a restoration.<\/p>\n\n

Unlike a conventional SQLi, this flaw is second-order (stored SQLi)<\/strong>: the malicious payload can initially be stored as seemingly legitimate content\u2014for example, through trackbacks<\/em> accepted by a public WordPress post\u2014and remain dormant. The payload is subsequently activated if an administrator exports the site and then restores\/imports that file with the vulnerable plugin.<\/p>\n\n

During that process, improper handling of backslashes and quotes can allow the stored content to escape the bounds of the intended SQL string and execute as an additional query. This can enable extraction of sensitive information from the database, including the ai1wm_secret_key value, used to protect the plugin’s import function.<\/p>\n\n

With access to that key, an attacker could abuse the import function to upload a malicious .wpress file containing, for example, a must-use<\/em> plugin (mu-plugin). Because these plugins are loaded automatically in WordPress, the attack chain can lead to remote code execution (RCE)<\/strong>, installation of webshells, information theft, malware deployment, or full site takeover.<\/p>\n\n

\"\"<\/figure>\n\n

Figure 1 Conditions for the exploitation chain<\/p>\n\n

Solution<\/h2>\n\n

Immediately update<\/strong> All-in-One WP Migration and Backup to version 7.110 or later<\/strong>.<\/p>\n\n

\n
All-in-One WP Migration and Backup<\/a><\/blockquote>