A Critical Flaw in a Popular WordPress Backup Plugin Just Got Fixed. Here's What Happened

I've written a fair amount on this site about backing up WordPress properly. So when I saw that a popular backup plugin itself had just become the attack vector for a full site takeover, I wanted to cover it here, not just link out to a security blog and move on.

What's actually vulnerable

The plugin is All-in-One WP Migration and Backup, made by ServMask, and it's genuinely widespread, with more than 5 million active installs according to WordPress's own plugin data. The flaw is tracked as CVE-2026-19949, rated 8.8 out of 10 on the CVSS scale. Wordfence credits security researcher Jack Taylor with finding it and reporting it responsibly through their bug bounty program. Every version up to 7.109 is affected. The fix landed in version 7.110, released on August 20, 2026. If you're running this plugin, the first thing to do is check your version, not read the rest of this article first:

wp plugin list --name=all-in-one-wp-migration

If you're not using WP-CLI, the plugin list in your WordPress dashboard shows the same thing. Anything below 7.110 needs updating right now.

How the attack actually works

This one is a genuinely clever chain, and I think understanding it helps explain why it's serious even though it doesn't need a login to start. An attacker submits two trackbacks to any public post on your site, each one containing a trailing backslash and a URL pointing to their own payload. WordPress core normally accepts trackbacks like this without much scrutiny. The malicious input gets stored as-is, backslash included. Here's the part that makes it dangerous specifically because of what this plugin does. When an admin later archives the site and then restores that archive, which is the plugin's entire purpose, it rewrites URLs and table prefixes inside the stored SQL during that process. The attacker's backslash and payload get promoted from stored text into something that behaves like actual SQL. That process ends up writing the site's secret restore key into a comment, which gets approved and becomes publicly visible. From there, the attacker reads that key straight off your site's own comments REST API, uses it to submit a crafted backup archive of their own, and that archive contains a malicious plugin that runs the moment the page next loads. That's remote code execution, achieved without ever logging in, triggered by an admin doing the completely normal, routine thing of restoring a backup.

What to do beyond just updating

Updating to 7.110 closes the hole for anything going forward. It doesn't undo anything that may have already happened if you were running a vulnerable version with public trackbacks enabled. A few things worth checking:

• Look through your post comments for anything that looks like a random string rather than an actual comment. That's the pattern this exploit leaves behind.
• Check whether trackbacks are enabled on your site at all. If you don't use them, and most sites genuinely don't, turning them off in Settings, Discussion removes this specific attack path entirely, independent of the plugin fix.
• If you've restored a backup recently and you're at all unsure whether your site was targeted, it's worth reviewing your installed plugins list for anything you don't recognize.

Why this is worth internalizing beyond this one plugin

If you followed our own guide on backing up MySQL to Cloudflare R2, you're not affected by this specific plugin vulnerability, since that approach doesn't touch this plugin at all. But the underlying lesson applies regardless of which backup method you use. A backup and restore tool sits in an unusually trusted position on your server. It reads and writes your entire database, and its job is specifically to take stored data and turn it back into something the server executes. That's exactly the kind of tool where a subtle input-handling bug turns into full compromise, not just data corruption. Whatever you use for backups, keep it updated the same way you'd keep WordPress core updated, and don't treat "it's just a backup plugin" as a reason to deprioritize its update notifications.

I verified the CVE details, affected versions, and fix in this guide against Wordfence's own vulnerability disclosure and ServMask's changelog as of August 2026.