SQL injection in servmask All-in-One WP Migration and Backup
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-19949
- 2026-10-03 Alias added: GHSA-wgw6-99h6-924c
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/22e273d9-a268-4dc5-b1f6-3bc5c29232c5?source=cve
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1637
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1250
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1726
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/model/import/class-ai1wm-import-database.php#L1065
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/controller/class-ai1wm-main-controller.php#L1336
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/controller/class-ai1wm-import-controller.php#L68
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3656677%40all-in-one-wp-migration&new=3656677%40all-in-one-wp-migration
More servmask vulnerabilities
- TI-2023-20896 Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins CVSS 3.1HIGH 7.3
- TI-2024-08507 All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection CVSS 3.1HIGH 7.2
- TI-2022-01350 All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts CVSS 3.1MEDIUM 6.6
- TI-2022-02352 All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS CVSS 3.1MEDIUM 4.7
- TI-2024-10143 All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection CVSS 3.1HIGH 7.5
- TI-2021-06508 All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE CVSS 3.1HIGH 7.2
Sources
- CVE-2026-19949 · CVE Program
- CVE-2026-19949 · NVD
- FIRST EPSS
- GHSA-wgw6-99h6-924c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences