A high-severity vulnerability in the All-in-One WP Migration and Backup plugin has put about 5 million WordPress sites in range of SQL injection attacks. The report, dated September 3, 2026, says unauthenticated attackers could take over vulnerable sites. No login required.

If you run a shop site, a blog, a church page, or a client site on WordPress, this one is aimed at you. A lot of regular people installed this plugin because it makes backups and site moves simple. Simple and everywhere is where attackers go looking.

What this SQL injection flaw actually means

SQL injection is a way to sneak extra commands into the database that runs your site. Your posts, users, passwords, and store data all live there. If a plugin does not handle input the right way, an outsider can read it, change it, or take the site.

The report calls this high-severity. The part that should bother you is the unauthenticated piece. Nobody has to steal your admin password first. If the vulnerable plugin is sitting on a public site, they can try the door from the open internet.

Why 5 million WordPress sites is not an abstract number

Five million installs is restaurants, contractors, nonprofits, freelancers, and small shops that added a backup plugin and then forgot it was there. Those sites do not have a security team. They have one person who logs in when something breaks.

That is who gets hurt. Not a giant company with a SOC. The folks who would never see a vulnerability write-up unless somebody translates it into English.

If All-in-One WP Migration and Backup is on your site

• Open WordPress, go to Plugins, and look for All-in-One WP Migration and Backup.
• If it is installed, check for an update and install it immediately if one is there.
• If no update is available yet, deactivate the plugin on a live public site until a fix ships.
• Keep a backup you control outside this plugin, such as a host backup or files you downloaded yourself.
• Look for admin users you did not create, pages you did not write, and plugins you did not install.

Do not wait until the weekend. Once a hole like this is public, automated scans start knocking. Later is how sites get taken.

The real problem is the plugin pile, not just this one tool

WordPress plugins with huge install counts are a single point of failure for millions of normal websites. One sloppy database query and the mess lands on people who never asked to be in the security business.

Run fewer plugins. Update the ones you keep. Delete the rest. Treat a backup plugin like the lock on the shop door, not a set-it-and-forget-it widget.

Look out for your own people. Update it, or get it off the site until you can.

Primary Source: https://cybersecuritynews.com/wordpress-all-in-one-wp-migration-plugin-flaw/