SQL Injection Flaw in All-in-One WP Migration and Backup Plugin Threatens Millions of WordPress Sites

What happened

According to BleepingComputer, an SQL injection vulnerability was discovered in the All-in-One WP Migration and Backup plugin for WordPress. The report states the flaw could allow unauthenticated attackers to execute remote code and take control of affected websites. No CVE identifier, patch status, or vendor advisory details were included in the reporting available at this time.

Why it matters for defenders

All-in-One WP Migration and Backup is a widely deployed plugin used for site backup and migration, meaning the potential exposure spans a large number of WordPress installations. An unauthenticated SQL injection path to remote code execution is a severe combination: it requires no valid credentials and, if confirmed, could give attackers full control over compromised sites — including web shell deployment, data theft from the WordPress database, and pivoting to hosting infrastructure.

Who is affected

Any WordPress site running the vulnerable plugin version is potentially at risk. Site administrators and managed WordPress hosting providers should treat this as a priority to investigate until official patch guidance is available.

What defenders should watch for or do now

• Check installed plugin versions of All-in-One WP Migration and Backup and monitor the vendor's changelog/support channels for a security patch.
• Review web server and WAF logs for anomalous requests targeting plugin-specific admin-ajax or REST endpoints, especially those containing SQL metacharacters or unusual parameter payloads.
• Audit the WordPress database for unexpected new admin users, modified user roles, or unfamiliar scheduled tasks/cron entries that could indicate post-exploitation.
• Look for newly created or modified PHP files in plugin/theme directories and uploads folders, which can indicate web shell deployment following RCE.
• Where patching isn't immediately available, consider restricting or disabling the plugin's exposed endpoints via a WAF rule until a fix is confirmed.
• As a general hardening step, ensure regular WordPress core, theme, and plugin updates, and limit direct database access from the web tier where possible.

Developing story

This is net-new intelligence based on initial reporting, and technical specifics such as a CVE identifier, affected version range, and patch availability have not yet been detailed. Defenders should follow up directly with the plugin vendor and monitor for updates. Read the original report from BleepingComputer: WordPress backup plugin flaw exposes millions of sites to takeover attacks.