The All-in-One WP Migration and Backup plugin, which has more than 5 million active installations, has been found to have a high-severity SQL injection vulnerability. The flaw allows unauthenticated attackers to plant malicious SQL that can be executed when a site administrator restores an archive.
The vulnerability affects versions up to 7.109 and can be used to expose the plugin’s secret key and ultimately achieve remote code execution, potentially leading to a complete site takeover. A patched version, 7.110, has been released to address it.
Root cause of the vulnerability
The vulnerability is an unauthenticated second-order SQL injection in the plugin’s archive restore functionality. This means an attacker can first store malicious input on a site, which is only processed later when an administrator performs an export and then restores the site from an archive.
According to Wordfence, the malicious input is introduced through WordPress core’s trackback functionality, which does not require authentication. An attacker can submit specially crafted trackbacks to a public post, causing malicious data to be stored in the site’s comments table. The data becomes exploitable when the site is exported and subsequently imported through All-in-One WP Migration and Backup.
During the import process, the plugin processes stored SQL statements while rewriting URLs and database table prefixes. Wordfence found that the regular expression used to identify SQL string values does not correctly handle sequences of backslashes. This can cause the plugin to misidentify where a string ends, allowing attacker-controlled data to escape the intended string and be interpreted as executable SQL.
The injected SQL can then be used to retrieve the plugin’s ai1wm_secret_key value from the database. The attacker can obtain that leaked key through the site’s public comments API and use it to pass the check protecting the plugin’s unauthenticated import functionality.
With the leaked key, the attacker can upload a specially crafted .wpress archive containing a malicious must-use plugin. Once the archive is processed, the malicious plugin is placed in the site’s mu-plugins directory and runs when WordPress loads it, giving the attacker remote code execution.
The vulnerability affects All-in-One WP Migration and Backup versions 7.109 and earlier. It was reported by security researcher Jack Taylor through the Wordfence Bug Bounty Program, for which he received a $5,761 bounty. The patched version 7.110 was released on August 20, and users should update to the latest available version immediately.