Overview
- Security researcher Jack Taylor and Wordfence disclosed a second‑order SQL injection, tracked as CVE-2026-19949, that lets attacker-supplied data stored in public inputs run as SQL during an administrator’s export, import, or restore.
- The injected SQL can cause the plugin to write its ai1wm_secret_key into public content, which an attacker can then read to perform an unauthenticated import of a crafted .wpress archive that can execute PHP and yield full site takeover.
- ServMask released a fix in version 7.110, which the vendor published on August 20 to address the vulnerability.
- Only about 35% of installations had updated by early September, leaving roughly 3.2–3.3 million of the plugin’s more than 5 million active sites potentially vulnerable and at risk when routine restores occur.
- Responders should update to v7.110, remove or patch old copies, rotate the ai1wm_secret_key and related credentials, hunt historic public inputs and restore logs for leaked keys or unknown .wpress imports, and check for new PHP files or unexpected outbound connections.