All-in-One WP Migration: Unauthenticated Second-Order SQLi

Threat Overview

A high-severity second-order SQL injection vulnerability in the popular All-in-One WP Migration and Backup plugin affects over five million active WordPress sites. The flaw resides in the plugin’s archive restoration workflow, enabling unauthenticated attackers to exfiltrate critical database secrets and ultimately execute arbitrary code on the server.

The Breakdown: How the Exploit Works

Unlike a typical SQL injection attack that executes immediately, this vulnerability is “second-order,” meaning the payload lies dormant before being triggered.

An unauthenticated attacker first plants a crafted payload on a target site using the standard WordPress core trackback feature, which accepts public pings on posts. The payload contains backslashes and specific URL parameters. This data is written harmlessly to the comments database table.

The exploit triggers when an administrator later exports the website using the plugin and imports it on another server. During the database-restore pass, the plugin executes regular expressions to rewrite URLs and database table prefixes. A parsing flaw in the regex handling allows the stored backslashes to escape intended SQL string boundaries, elevating the dormant payload into executable SQL commands. This injected SQL forces the plugin to retrieve its own ai1wm_secret_key and write it into a public comment, which the attacker retrieves via the site’s public WordPress REST API.

The Operational Risk: What an Attacker Gains

With the retrieved ai1wm_secret_key, the attacker can bypass administrative authentication on the plugin’s upload endpoint and execute highly destructive actions:

• RCE via Malicious Must-Use Plugin: Attackers use the secret key to authenticate and upload a crafted .wpress backup archive that bundles a malicious must-use (MU) plugin.
• Immediate Administrative Backdoors: Since MU plugins are executed automatically by WordPress upon any page load, the malicious code runs instantly, giving the attacker full remote shell access, data exfiltration capabilities, and persistent control.

Our Take in Plain English

“Local backup plugins make copying your site convenient, but they run high-privilege SQL rewrite routines directly inside your dynamic web process. Because your live server exposes public trackback and comment endpoints, attackers can plant sleeping SQL queries that activate the moment an administrator runs a standard migration. By utilizing a compiled edge delivery system, backup and migration pipelines are handled completely offline or through secure, authenticated staging channels, removing the vulnerability vectors of runtime database-modifying plugins.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Integrates critical infrastructure tasks (like database backup and restoration) directly into the live web server’s execution context, exposing high-privilege database write actions to public-facing input variables.
• Modern Pre-Rendered Architecture: Operates with zero database reliance at the edge. Site deployment, URL rewriting, and migrations are processed strictly within a secure, isolated build pipeline or offline environment. There are no public SQL injection vectors or live administrative comment endpoints for bots to target.

Immediate Action Items for WordPress Operators

1. Update the Plugin: Upgrade All-in-One WP Migration and Backup to version 7.110 or higher immediately.
2. Disable Trackbacks: Fully disable trackbacks and pingbacks across all public-facing WordPress posts to prevent dormant payload planting.
3. Limit User Privileges: Audit subscriber, contributor, and author-level accounts to ensure only trusted operators have permissions that could interface with data-import workflows.