WordPress Backup Plugin Flaw: Is Your Site Protected?

One of the most widely installed WordPress plugins in the world has a serious security flaw that is actively being targeted, and millions of website owners have not yet applied the fix. If your business runs a WordPress site – whether we manage it for you or you look after it yourself – here is what you need to know.

What happened

Security researchers disclosed a critical vulnerability in the All-in-One WP Migration and Backup plugin (tracked as CVE-2026-19949) on 14 August 2026. The plugin is installed on more than five million WordPress sites worldwide and is one of the most popular tools for moving a WordPress site between servers and for taking regular backups.

The flaw is classified as an unauthenticated SQL injection with a severity score of 8.8 out of 10. In plain terms: an attacker does not need a username or password to start exploiting it. They can plant specially crafted data into your site via the comment and trackback system. That data sits quietly until a site administrator imports or restores a backup archive, at which point the plugin processes the malicious content and the attacker can steal a key credential – giving them remote access to, and full control of, the site.

The developer, ServMask, released a fix in plugin version 7.110 on 20 August 2026. As of 2 September, however, only around 35 per cent of the install base had updated, meaning roughly 3.25 million sites remain exposed. Working exploit code is already in public circulation.

Why this matters to your business

A compromised website is not just an IT inconvenience. A successful attack can result in:

• your site being used to host phishing pages or malware that target your visitors
• customer data and contact form submissions being stolen
• your site being defaced or taken offline entirely
• Google flagging your site as dangerous, damaging your search rankings and reputation
• attackers using your hosting account as a launchpad for further attacks

WordPress powers roughly 43 per cent of all websites on the internet, which makes it the biggest single target for automated scanning tools. These tools constantly probe for known vulnerable plugins, and the window between a public disclosure and the first attempted attacks is often measured in hours, not days.

What we have already done for managed clients

If System Force manages your WordPress website, we have already reviewed your plugin versions and applied the update where needed. Our managed WordPress clients are prioritised for patching whenever a critical vulnerability like this is disclosed – it is exactly what our ongoing maintenance work is designed to catch quickly.

Our IT security services include website security monitoring and patch management, so vulnerabilities like this are flagged and resolved without you needing to lift a finger.

What to check if you manage your own site

If you look after your own WordPress installation, do the following as soon as possible:

1. Log in to your WordPress admin dashboard and go to Plugins.
2. Check whether All-in-One WP Migration or All-in-One WP Migration and Backup is installed.
3. Check the version number – you need to be on version 7.110 or later.
4. If an update is available, apply it now.

While you are there, update all other plugins and WordPress core to the latest versions. Outdated plugins are the leading cause of WordPress site compromises, and this is the second high-profile plugin vulnerability in just a few weeks – as we covered in our recent post on the critical WordPress flaw being actively exploited in August.

If you are unsure whether your site is running a safe version, or you are not comfortable applying updates yourself, we are happy to review it for you.

The bigger picture

Keeping WordPress and its plugins up to date is not a one-off task – it is ongoing work that requires regular attention. Each new plugin vulnerability is a reminder that unmanaged websites carry real business risk.

For clients on a managed IT support contract with us, we handle routine patching and prioritise critical updates like this one. We can also extend that cover to your website if it is something you would rather not have to think about.

You can read more about why staying on top of WordPress maintenance is a genuine business risk in our post: WordPress 7.1 Is Out: Why Keeping It Patched Is a Business Issue.

What to do next

If you have the All-in-One WP Migration plugin installed, check your version and update to 7.110 today. If you are not sure whether your site is affected, speak to whoever manages your WordPress installation.

If you would like System Force to take care of your website security and updates going forward, get in touch or call us on 01452 701355 for a no-obligation chat about what managed IT and website support looks like for your business. You can reach us via our contact page.