5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in All-in-One WP Migration and Backup, a WordPress plugin with more than 5 million active installations. This vulnerability makes it possible for unauthenticated attackers to inject SQL...

WordPress All-in-One WP Migration Unlimited Extension plugin <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'ai1wmbackupspath' Parameter vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin All-in-One WP Migration Unlimited Extension versions = 2.84...

CVE-2026-6128

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

CVE-2026-6128

The All-in-One WP Migration Unlimited Extension WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the ai1wm_backups_path parameter in all versions up to and including 2.84 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes, co...

EUVD-2026-67648

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

CVE-2026-6128 All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

CVE-2026-6128: Improper Neutralization of Input During Web Page Generation

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

PT-2026-83073

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm backups path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes...

WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability

Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...

CVE-2026-19949

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

EUVD-2026-65463

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-19949

The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....

CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2026-81268

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.110 Description An unauthenticated second-order SQL injection exists in the archive restore functionality. This occurs because user-supplied parameters are insufficiently escaped and SQL...

CVE-2026-19949: Improper Neutralization of Special Elements used in an SQL Command

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

WordPress All-in-One WP Migration and Backup plugin < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability

Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability discovered by Mohamed Bassia in WordPress Plugin All-in-One WP Migration versions 7.108...

CVE-2026-17533

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...

EUVD-2026-59911

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...

CVE-2026-17533 All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...