An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin exposes WordPress sites to remote code execution and complete takeover by unauthenticated attackers.
The flaw affects one of WordPress's most widely-used backup solutions, potentially impacting millions of installations across the web. Attackers can exploit the SQL injection vulnerability without requiring authentication, gaining ability to execute arbitrary code and seize control of compromised websites.
The Vulnerability
The All-in-One WP Migration and Backup plugin fails to properly sanitize user input in its database queries. This allows attackers to inject malicious SQL commands through vulnerable endpoints. By leveraging this access point, adversaries can escalate privileges, extract sensitive data, modify website content, or install backdoors for persistent access.
Scope of Impact
The plugin boasts over 3 million active installations according to WordPress.org statistics. Organizations and individuals relying on this tool for critical backup operations face immediate risk. The vulnerability affects multiple plugin versions, though exact version ranges remain under investigation.
Immediate Actions
WordPress site administrators should:
- Update the All-in-One WP Migration and Backup plugin immediately if a patched version is available
- Disable the plugin temporarily if no patch exists
- Review database access logs for suspicious activity
- Check for unauthorized user accounts or code modifications
- Consider implementing Web Application Firewall (WAF) rules to block exploitation attempts
Broader Context
This incident follows a pattern of critical vulnerabilities in popular WordPress plugins. Such flaws underscore the security challenges posed by WordPress's decentralized plugin ecosystem, where third-party developers maintain security responsibility.
WordPress administrators should maintain updated plugins, limit plugin usage to necessary tools, and implement regular security audits. Backup functionality remains essential, but users should prioritize switching to alternatives with stronger security records or waiting for verified patches before resuming standard operations.
An identity theft search site claimed to possess over 150 million driver's license photos stolen from a major ID verification service. The crime site has since been shut down.
Iran-linked hackers have compromised approximately 100 American water utilities in a sustained campaign targeting critical infrastructure. The EPA is allocating $11 million in funding to strengthen cybersecurity defenses across water systems.
Attackers exploited BGP routing vulnerabilities to redirect Virtualizor VPS management software update requests to malicious servers. The compromise affected users attempting to download legitimate updates for the widely-used hosting control panel.
A critical authentication bypass vulnerability in JFrog Artifactory is being actively exploited to create administrative access tokens. The flaw (CVE-2026-82329) grants attackers full control over software repositories.