A critical vulnerability in All-in-One WP Migration and Backup, a plugin used on more than 5 million WordPress sites to move and back up sites, can let an attacker take over your site the next time you restore an archive.

What happened

Wordfence says the flaw affects versions below 7.110 and is an unauthenticated, second-order SQL injection. An attacker doesn’t need a login to plant the malicious SQL. It sits dormant until a site administrator restores a backup archive, at which point the plugin runs the injected SQL because it doesn’t properly escape or prepare the query.

That injected code can extract the plugin’s secret key, ai1wm_secret_key. Wordfence says an attacker who gets that key can use it to achieve remote code execution, leading to complete site takeover. Because the trigger is a routine restore action rather than anything unusual, a site owner could set off the attack simply by doing normal backup maintenance on an archive an attacker had already tampered with.

Researcher Jack Taylor reported the bug through the Wordfence Bug Bounty Program and earned a $5,761 payout for the find. Wordfence Premium, Care, and Response customers received a firewall rule blocking known exploit attempts on August 16. Sites on the free version of Wordfence get the same protection on September 15, 30 days later.

What to do

  1. Update All-in-One WP Migration and Backup to version 7.110 or later from your WordPress dashboard.
  2. Only restore backup archives you trust. Treat any archive from an unknown or unverified source as a risk until you’ve updated the plugin.
  3. If you use the free version of Wordfence, your firewall protection doesn’t arrive until September 15. Update the plugin itself rather than waiting on that rule.
  4. If you’ve restored an archive recently and haven’t updated yet, check your site for unfamiliar admin accounts or unexpected changes.

End of article