All-in-One WP Migration and Backup has more than five million active installs. The patch for CVE-2026-19949 is already out — version 7.110 — and about 3.25 million sites are still on a vulnerable release. That is not a news problem. It is a portfolio question: which of your sites still need the update, and does it jump the queue?

BleepingComputer reported the issue after Wordfence validated researcher Jack Taylor’s finding. The flaw is a second-order SQL injection in how the plugin rewrites database content during archive restoration. An unauthenticated attacker can plant crafted data through WordPress trackbacks. It stays dormant until an administrator exports and imports, or restores a backup — the plugin’s core job. The injected SQL can expose the import secret key, after which an attacker can upload a malicious .wpress archive and take over the site.

ServMask shipped 7.110 on 20 August. The remaining work is version inventory, not another recap of the CVE.

How to rank this CVE

Start with inventory. Any connected site running All-in-One WP Migration below 7.110 is in scope. Deactivated copies matter less, but they can still be exploited if someone turns the plugin back on for a migration.

  • Patch this week, before the next restore. The payload does not fire on every page load. It fires when someone uses the plugin. Backup and restore is the product, so treat that as a routine action, not a rare edge case.
  • Raise it on sites that actually migrate. Staging refreshes, host moves, and agency clones make this more urgent than a brochure site that has never run an import.
  • Do not drop every other finding. A high-severity takeover path belongs above maintenance debt. It does not mean you ignore EOL PHP or an already-exploited RCE on another plugin. Sequence the work; do not panic-swap the whole queue.

That is the same filter as what to fix first when CVE alerts pile up: exploitability and a real trigger beat a scary headline.

What WP Triage would do

WP Triage would not have blocked the attack. It is not a firewall. On sites still below 7.110, it should match the outdated plugin, drop those risk scores, and put “update to 7.110” in the top three instead of leaving it in a scanner dump.

That is the job: make the unpatched installs obvious, then tell you which site to open first. See how WordPress risk scoring works, or how agencies run a weekly triage block.

Connect your sites if you want that inventory instead of grepping plugin versions by hand.