SQL Injection Vulnerability in All-in-One WP Migration and Backup Plugin Poses Takeover Risk for WordPress Sites

A SQL injection vulnerability has been identified in the All-in-One WP Migration and Backup plugin for WordPress, according to a report published by BleepingComputer on September 2, 2026. The flaw stems from insufficient input sanitisation within the plugin, potentially allowing unauthenticated attackers to inject malicious SQL queries. Successful exploitation could enable remote code execution on the server, resulting in full website takeover. The report notes that the vulnerability affects the All-in-One WP Migration and Backup plugin, a widely used tool for migrating and backing up WordPress sites. While the exact scope of affected versions and confirmation of active exploitation in the wild are pending further validation, the potential impact is significant given the plugin's popularity. The report does not assign a specific CVE ID at this time. WordPress site administrators are strongly encouraged to update the plugin to the most recent version to address the flaw.