CVE-2026-19949: falha de alta gravidade em servmask All-in-One WP Migration and Backup
All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
Publicada em · Atualizada em
63Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck e tem prova de conceito pública.
ssvc Actcvss 8.8epss 1.4%
da publicação à arma9 dias
Publicada no NVD25 de ago.
1ª PoC+9d
VulnCheck+49d
probabilidade de exploração
1.4%top 27% das CVEs
exploração observada
simVulnCheck
4 exploit(s) público(s)
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
servmask · All-in-One WP Migration and BackupPoCs públicas encontradas — 4
githubgithub.com/686f6c61/POC-AIOWPM-CVE-2026-19949★ 6githubgithub.com/katranSefa/CVE-2026-19949★ 1githubgithub.com/HORKimhab/CVE-2026-19949★ 0vulncheckvulncheck.com/xdb/5d6f791570d3não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — servmask All-in-One WP Migration and Backup
No mesmo produto, das mais perigosas para as menos.
CVE-2022-1476MEDIUMAll-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows HostsEPSS 46.3%CVE-2024-9162HIGHAll-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code InjectionEPSS 2.7%CVE-2024-8852MEDIUMAll-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error LogsEPSS 1.2%CVE-2024-10942HIGHAll in One WP Migration <= 7.89 - Unauthenticated PHP Object InjectionEPSS 0.6%CVE-2026-89064MEDIUMAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic HeaderEPSS 0.5%CVE-2025-8490MEDIUMAll-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via ImportEPSS 0.2%
Referências
https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/controller/class-ai1wm-import-controller.php#L68https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/controller/class-ai1wm-main-controller.php#L1336https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/model/import/class-ai1wm-import-database.php#L1065https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1250https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1637https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.109/lib/vendor/servmask/database/class-ai1wm-database.php#L1726https://plugins.trac.wordpress.org/changeset?reponame=&old=3656677%40all-in-one-wp-migration&new=3656677%40all-in-one-wp-migrationhttps://www.wordfence.com/threat-intel/vulnerabilities/id/22e273d9-a268-4dc5-b1f6-3bc5c29232c5?source=cve