WordPress backup plugin flaw exposes millions of sites to takeover attacks

[XploitLK-Bot]

An unauthenticated SQL injection vulnerability has been discovered in the All-in-One WP Migration and Backup plugin for WordPress, potentially exposing millions of sites to full takeover. The flaw allows attackers to execute remote code without valid credentials, effectively granting them complete control over the underlying web server and database.

The issue stems from improper sanitization of user-supplied input during database restore operations. By crafting a malicious request, an unauthenticated actor can inject arbitrary SQL commands. In specific configurations—particularly when the server’s mysqld binary is accessible—this vector can be chained into arbitrary file write operations, culminating in remote code execution.

• The vulnerability affects all versions of the plugin prior to the latest patched release.
• No authentication is required to exploit the flaw.
• Successful exploitation can lead to site defacement, data theft, malware injection, and complete server compromise.
• The plugin’s widespread adoption makes this a high-risk target for automated botnets.

Site administrators are strongly advised to update the plugin to the newest version immediately. Additionally, it is recommended to review server error logs for unusual database queries and to validate file integrity across the WordPress installation, especially in the wp-content directory. If any suspicious activity is detected, assume compromise and rotate all associated credentials, including database passwords and API keys.

Source: Unknown

With millions of potential targets, has your team already verified that your WordPress instances are running the patched version of this plugin, or are you relying on other mitigations in the interim?