All-in-One WP Migration plugin SQL injection enables site takeover

Affected Systems

All-in-One WP Migration and Backup plugin for WordPress, versions through 7.109. Over 5 million active installations, with approximately 3.25 million sites (65%) still running vulnerable versions. Fixed in version 7.110.

Exploitation Status

No active exploitation reported. Vulnerability requires administrator action (backup export/import) to trigger, but this is routine for the plugin's core functionality. Proof-of-concept details disclosed by Wordfence.

Business Impact

Unauthenticated attackers can plant malicious SQL via WordPress trackbacks. When an admin exports and imports site data (common operations), the injected SQL executes, exposing the plugin's secret import key through public comments. Attackers can then import malicious archives containing executable code, leading to full site compromise. The delayed trigger reduces immediate risk but does not eliminate it, as backup/restore operations are routine for this plugin.

Urgency

🟠 Within 24 hours

Recommended Actions

• Update All-in-One WP Migration and Backup plugin to version 7.110 or later immediately on all WordPress installations
• Audit WordPress sites for the plugin using version 7.109 or earlier; prioritize sites where backup/restore operations are frequent
• Review public comments and trackbacks for suspicious content or SQL injection attempts on sites running vulnerable versions
• Monitor for unauthorized creation or modification of .wpress archive files and unexpected exposure of ai1wm_secret_key values
• Consider temporarily disabling the plugin on non-critical sites until patching is complete, noting that reactivation on vulnerable versions still poses risk