All-in-One WP Migration CVE-2026-19949: From Second-Order SQL Injection on Restore to Site Takeover

WordPress backup plugin flaw exposes millions of sites to takeover attacks

An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites.