Executive brief
The All-in-One WP Migration and Backup plugin for WordPress contains a SQL injection vulnerability in its archive restore functionality that can be exploited by unauthenticated attackers. By manipulating input parameters during a restore operation, attackers can extract sensitive data from the database, including secret keys that could lead to remote code execution on the affected WordPress site.
Technical details
The vulnerability is a SQL injection flaw in the archive restore functionality, caused by insufficient escaping of user-supplied input and lack of prepared statement usage in SQL queries. The vulnerability is triggered when a site administrator performs an archive restore, allowing an unauthenticated attacker to inject malicious SQL queries. This enables attackers to extract the ai1wm_secret_key from the database, which can then be leveraged to achieve remote code execution. The flaw affects all versions up to and including 7.109.
Affected products
- ServMask All-in-One WP Migration and Backup up to 7.109
Timeline
- 2026-08-25: disclosed