A high-severity vulnerability in a widely used WordPress backup plugin could expose millions of websites to takeover attacks, according to BleepingComputer, which cites findings from Wordfence researchers. The flaw affects All-in-One WP Migration and Backup, a plugin used to back up, export, import, and move WordPress sites, including databases, media, themes, and plugins. BleepingComputer reports that the vulnerability is tracked as CVE-2026-19949 and affects plugin versions through 7.109. According to the report, the issue is a second-order SQL injection bug tied to how the plugin handles escaped backslashes and quotation marks while rewriting database content during archive restoration. In the attack path described by Wordfence, an unauthenticated attacker could plant crafted data through WordPress trackbacks. That data would not execute immediately; it would be triggered later when an administrator exports and imports or restores the site. BleepingComputer reports that the injected SQL could expose the plugin’s secret import key, identified as ai1wm_secret_key, through a public comment. With that key, an attacker could import a malicious .wpress archive containing executable code. Wordfence said code execution at that privilege level may allow full control of the targeted website, according to the report. The timing requirement matters. The payload reportedly remains dormant until a site administrator restores a backup archive, which makes exploitation less immediate than a direct unauthenticated remote-code-execution bug. But Wordfence’s concern, as relayed by BleepingComputer, is that backup and restore operations are central to the plugin’s normal purpose, so the triggering action is not unusual. The disclosure timeline is relatively short. BleepingComputer reports that security researcher Jack Taylor discovered the flaw and reported it in mid-August through Wordfence, Defiant’s cybersecurity branch. Wordfence disclosed the issue to the plugin’s developer, ServMask, on August 15, after validating the finding. ServMask addressed CVE-2026-19949 in version 7.110 on August 20. The scale is the main operational concern. BleepingComputer cites WordPress.org statistics showing All-in-One WP Migration and Backup has more than five million active installations. Since the fix, the report says only about 35% of the plugin’s user base has updated, leaving approximately 3.25 million sites running a vulnerable version. For site owners, the immediate action is narrow: update All-in-One WP Migration and Backup to version 7.110 or later. BleepingComputer also reports Wordfence’s view that a deactivated vulnerable copy poses less risk, but could still be exploited if temporarily activated. Who benefits: Attackers benefit if they can plant data and wait for a restore workflow to trigger the exploit. Website operators benefit from a clear fixed version: All-in-One WP Migration and Backup 7.110. Who's exposed: Sites running All-in-One WP Migration and Backup versions through 7.109 are the exposed population described in the report. BleepingComputer says about 3.25 million installs may still be on vulnerable releases.