WordPress Plugin Flaw Lets Attackers Turn SQL Injection Into Complete Site Takeover

A critical unauthenticated second-order SQL injection (CVE-2026-19949) in the All-in-One WP Migration plugin (affecting versions up to 7.109) allows attackers to store crafted data (e.g., via public trackbacks) that later escapes its SQL string context during backup restore, enabling leakage of the plugin's secret key and unauthenticated import of a malicious must-use plugin that can achieve remote code execution and full site takeover; the issue is fixed in version 7.110 and administrators are advised to update immediately, review trackback/comment usage, and investigate recent restore activity.