If your WordPress site uses All-in-One WP Migration and Backup, check its installed version. Wordfence reports that versions up to and including 7.109 are affected by CVE-2026-19949, a second-order SQL-injection vulnerability connected to restoring an archive. The advisory identifies 7.110 as the first fixed version; the official plugin page listed 7.113 when this article was prepared on 4 November 2026. Install the latest version offered to your site, not just the minimum fix. See the Wordfence advisory, the CVE record and the official plugin page.
What is the vulnerability?
The issue involves data that can be planted and then processed later when an administrator restores a migration archive. The CVE record describes insufficient escaping in a database query. Wordfence explains that the attack chain could expose the plugin's secret key during an archive restore and potentially lead to further compromise.
That is a possible impact, not a statement that every old installation has been attacked. A vulnerable version means the site needs a prompt update; it does not prove that the site is infected. The attack also involves the archive-restore path, so a site owner should pay particular attention to who can upload or restore archives and where those files came from.
How do I check and fix it?
In WordPress Admin, open Plugins and find All-in-One WP Migration and Backup. If it is version 7.109 or older, update it as soon as practical. Version 7.110 is the minimum version identified as fixing this CVE, but the plugin had later releases by the time of this article. Verify the installed version after updating rather than relying only on a success notice.
Before updating, make sure you have a known-good backup of the database and files. Use the normal WordPress update mechanism or your managed host's process. Afterward, check the public site and admin dashboard, confirm the plugin version, and test the migration functions only with an archive you trust.
Do not restore an unexplained .wpress archive just to test whether the site is vulnerable. Verify the archive's origin and integrity first. If you cannot update immediately, pause archive restores and limit access to the migration tools; treat those as temporary precautions, not substitutes for installing the fix.
What if my site was on a vulnerable version?
Being exposed is not the same as being compromised. If you see unexpected imports, unfamiliar administrator accounts, suspicious database changes or modified plugin files, preserve the logs and investigate before deleting evidence or restoring over the site. A clean backup and a qualified site or incident-response review may be appropriate when indicators are present.
After patching, keep WordPress core, PHP, themes and plugins current and maintain a backup that is stored separately from the live site. Do not treat a security plugin alert, a scan, or the presence of an old version alone as proof that someone accessed your site.
For site scanning and WordPress security hardening, see Engage24's Website Security service. If the incident is also disrupting your team's email, computers or day-to-day work, Engage24 IT Support describes the business IT assistance currently offered.
Need help with an All-in-One WP Migration issue?
If you need help applying the fixed release, reviewing a restore problem or assessing site-specific warning signs, book time with Engage24.