Critical SQL Injection Vulnerability Found in WordPress Backup Plugin
A WordPress backup tool, intended to assist websites in recovering from disruptions, has emerged as a potential vector for cyber assaults.
Researchers have revealed a significant SQL injection vulnerability affecting the All-in-One WP Migration and Backup plugin, specifically in versions 7.109 and earlier.
Although this flaw was rectified in version 7.110, an estimated 3.25 million sites continued to operate with the vulnerable iterations as of September 2, as reported by Bleeping Computer.
Identified as CVE-2026-19949, the vulnerability poses a risk of exposing sensitive database information. In specific circumstances, it can unearth a plugin secret key, which researchers indicate could pave the way for remote code execution.
Mechanics of the SQL Injection Vulnerability
The flaw was unearthed by Jack Taylor, who communicated the issue to Wordfence through its bug bounty program on August 14. Wordfence promptly informed ServMask, the plugin’s developer, characterizing the flaw as a second-order SQL injection attack.
An attacker can initially deposit malicious input within the WordPress database, subsequently waiting for a legitimate operation designed for the plugin: exporting or restoring an archive.
This deferred execution qualifies the issue as a second-order SQL injection. The malicious input remains dormant, only posing a danger when the plugin retrieves it during an archive operation and injects it into a vulnerable database query.
At this juncture, the stored data can be executed as SQL, thus granting the attacker access to the WordPress database contents.
Among the information that may be compromised is the plugin’s secret key, which, according to researchers, can facilitate remote code execution. This escalates the vulnerability, ultimately enabling an assailant to seize control of the at-risk WordPress site.
The concern, therefore, extends beyond the mere ability of an attacker to inject SQL into a compromised site.
The implications involve premeditated attacks activated by routine administrative actions, which users of a backup and migration plugin would typically undertake.
The All-in-One WP Migration and Backup plugin boasts over 5 million active installations, though this does not imply that every installation is susceptible, as noted in Bleeping Computer’s report on September 2.
The Appeal of High-Privilege WordPress Plugins
Plugins that manage backups, user registrations, page building, and other administrative functions frequently interface with sensitive components of a WordPress installation.
This elevated level of access renders vulnerabilities in such tools particularly enticing to attackers, as a solitary flaw has the potential to compromise databases, user accounts, or critical site functionalities.
Earlier this year, a vulnerability discovered in the User Registration & Membership plugin enabled assailants to establish unauthorized admin accounts on WordPress websites. Likewise, a flaw within the Elementor Ally plugin threatened data integrity for over 400,000 sites.
This troubling pattern is increasingly conspicuous. The greater the control a plugin affords an administrator, the higher the stakes if a vulnerability is exploited.
Backup utilities, registration systems, page builders, and analogous plugins are situated perilously close to integral components of a WordPress site, implying that a single security lapse could transform a convenience feature into a gateway for malicious incursions.
Recommended Actions for Site Administrators
For those utilizing the All-in-One WP Migration and Backup plugin, the foremost task is to upgrade to version 7.110, which contains the necessary patches.
Additionally, this incident serves as a timely reminder to scrutinize all plugins currently operational on your WordPress site. A plugin may perform beneficial functions in the background, yet if it remains outdated, it may surreptitiously become the most vulnerable element in your site’s security framework.
Audit your installed plugins, eliminate those no longer in use, and ensure the remaining plugins are kept up to date as security updates are released.
WordPress allows site administrators to enable automatic updates for their plugins. Thus, for those who may neglect manual checks, utilizing the auto-update feature might be the most prudent option.
Ultimately, the immediate priority is crystal clear: if you have the All-in-One WP Migration and Backup plugin installed, ensure it is updated to a non-affected version.
In other news: A coder has reported a supply chain attack that allowed hackers to exploit its trusted registry path in order to distribute malicious Terraform modules, which captured cloud, CI/CD, AI-tooling, and SSH credentials over a span of approximately 14 hours.
Source link: Esecurityplanet.com.
