Two more remote code execution bugs worth your afternoon, both in plugins with very large install bases.
All-in-One WP Migration: CVE-2026-19949
A second-order SQL injection in the archive restore functionality, CVSS 8.8, exposing more than 3 million sites to remote code execution. ServMask shipped a fix in version 7.110 on 20 August 2026.
Backup and migration plugins are a particularly attractive target: they run with high privileges and routinely handle attacker-supplied archives. If you keep one installed permanently for occasional migrations, consider deactivating it between jobs.
Forminator Forms: CVE-2026-15748
An arbitrary file upload in handle_file_upload, CVSS 9.8. Insufficient file type validation allows unauthenticated attackers to upload executable files.
The pattern
All three of this month’s critical WordPress CVEs, including the Elementor Pro one, are file upload or input validation failures in code that accepts submissions from the public internet. If a plugin takes uploads from unauthenticated visitors, it deserves a much closer look than the rest of your stack.
Sources: SecurityWeek on All-in-One WP Migration, SecurityWeek on Forminator.