SQL Injection Flaw in WordPress Backup Plugin Exposes Millions of Sites to Takeover

Security researcher Jack Taylor discovered the vulnerability in mid-August and reported it through Wordfence, Defiant's cybersecurity arm. Wordfence disclosed the issue to the plugin's developer, ServMask, on August 15, and a fix was released in version 7.110 on August 20.

The vulnerability is a second-order SQL injection affecting versions up to 7.109. It stems from incorrect parsing of escaped backslashes and quotation marks during the database rewrite process that occurs when a site administrator restores a backup archive. An unauthenticated attacker can plant crafted data through WordPress trackbacks; that data stays dormant until the administrator performs a restore — a routine action for the plugin — at which point the injected SQL executes.

According to Wordfence, the injected SQL can expose the plugin's secret import key (ai1wm_secret_key) through a public comment. An attacker who obtains that key can then import a malicious '.wpress' archive containing executable code, potentially gaining full control of the website.

Despite the availability of a patch, WordPress.org statistics show that only about 35% of the plugin's user base has updated to version 7.110 or later, leaving approximately 3.25 million sites running a vulnerable release. Wordfence notes that a deactivated version of the plugin poses less risk, but it can still be exploited if temporarily activated.

Why This Matters

The plugin has over five million active installations, making this one of the most widely deployed WordPress plugins at risk.
The vulnerability can lead to complete site takeover, affecting everything from small blogs to e-commerce stores.
With 65% of installations still unpatched, the window for exploitation remains wide open, and attackers may already be scanning for vulnerable sites.

Background

WordPress powers a significant portion of the web, and its extensive plugin ecosystem is both a strength and a security challenge. The All-in-One WP Migration and Backup plugin is a popular tool for moving and backing up entire WordPress sites. SQL injection vulnerabilities in such widely used plugins have historically been a primary vector for website compromises. Second-order SQL injection, where the malicious payload is stored and executed later, is less common but can be harder to detect.

Key Perspectives

ServMask (plugin developer): Addressed the vulnerability within five days of disclosure, releasing version 7.110 on August 20. The company has not publicly commented on the patch adoption rate. Wordfence (security researchers): Warned that the exploit is straightforward for unauthenticated attackers and that the restore action is a routine part of the plugin's functionality, making exploitation likely over time. Site administrators and WordPress users: Face a critical choice: either update the plugin immediately or risk having their sites compromised. The burden of patching falls on individual site owners, many of whom may not be aware of the vulnerability.

What to Watch

The proportion of sites still running vulnerable versions; if the 35% patch rate does not improve quickly, mass exploitation attempts may follow.
Any reports of active exploitation in the wild, which could trigger a broader WordPress security advisory.
Whether ServMask will push automatic updates or add security hardening measures to future versions.

ZOTPAPER