All-in-One WP Migration: Four Vulnerabilities Disclosed This Season — Update to 7.110+

Introduction

All-in-One WP Migration and Backup, one of the most widely used migration and backup plugins for WordPress, has had four separate vulnerabilities disclosed recently. If you use it to migrate, back up, or restore sites, this is worth a careful read — especially the most recent one, which chains a SQL injection into potential remote code execution through the plugin’s own restore functionality.

The Four Vulnerabilities

1. Unauthenticated SQL injection via archive restore, leading to RCE (severity 8.8, fixed in version 7.110, disclosed August 24, 2026). Insufficient escaping in the restore process lets an attacker inject SQL, potentially extracting the plugin’s internal secret key — which can then be leveraged toward remote code execution.
2. Multisite subsite admin to network-wide PHP code execution via REST import (severity 7.2, fixed in version 7.108). On multisite installs, the plugin didn’t properly restrict migration imports to network administrators, letting a subsite admin run arbitrary PHP across the entire network.
3. Path traversal via a missing sanitization check (fixed in version 7.106). An unauthenticated attacker could create or append a log file outside the plugin’s intended storage directory by supplying a crafted value.
4. Missing authorization in the Unlimited Extension (a separate add-on). Low-privilege users, such as subscribers, could create scheduled export jobs and redirect backup notifications — including the backup’s filename — to an attacker-controlled email, enabling a full backup download.

What You Should Do Right Now

1. Check your installed version under Plugins in wp-admin. Anything before 7.110 is missing at least one of these fixes.
2. Back up your site with a different tool or method first if possible, given the vulnerabilities specifically involve the restore/backup pipeline itself.
3. Update to 7.110 or later right away.
4. If you run a multisite network, confirm every subsite is on a patched version, not just the main site.
5. If you use the Unlimited Extension add-on, update that separately and review any scheduled export jobs you didn’t create.

Why Backup/Migration Plugins Are a High-Value Target

There’s a particular irony to vulnerabilities in a backup plugin: the exact feature meant to protect your site — its restore and export functionality — is what attackers are exploiting. A backup plugin has legitimate reasons to read and write files broadly across your site, handle large uploads, and interact with your database directly, which is precisely the kind of access surface that becomes dangerous when a validation step is missing.

FAQ

Do I need to worry about all four, or just the most recent one?
Update to 7.110 or later and you’re covered for all four — there’s no need to patch them individually since each subsequent release included the prior fixes.

How do I check for the Unlimited Extension issue specifically?
Review your scheduled export/backup jobs in the plugin’s settings for anything you don’t recognize, and check where backup notification emails are being sent.

I run a multisite network — what’s my biggest risk?
The subsite-to-network-wide PHP execution flaw (fixed in 7.108) is the one to prioritize checking, since it lets a single compromised or malicious subsite admin affect your entire network.

Conclusion

Four disclosed vulnerabilities in one season on a major migration/backup plugin is a strong reminder to keep every tool touching your backups current — including whichever one you use. Update to 7.110+, and if you’re evaluating your backup setup in light of this, it’s worth taking stock of what else is running with that level of access to your site.