Two more remote code execution bugs worth your afternoon, both in plugins with very large install bases.
All-in-One WP Migration — CVE-2026-19949
A second-order SQL injection in the archive restore functionality, CVSS 8.8, exposing more than 3 million sites to remote code execution. ServMask shipped a fix in version 7.110 on 20 August 2026.
Backup and migration plugins are a particularly attractive target: they run with high privileges and routinely handle attacker-supplied archives. If you keep one installed permanently for occasional migrations, consider deactivating it between jobs.
Forminator Forms — CVE-2026-15748
An arbitrary file upload in handle_file_upload, CVSS 9.8. Insufficient file type validation allows unauthenticated attackers to upload executable files.
The pattern
All three of this month’s critical WordPress CVEs — including the Elementor Pro one — are file upload or input validation failures in code that accepts submissions from the public internet. If a plugin takes uploads from unauthenticated visitors, it deserves a much closer look than the rest of your stack.
Sources: SecurityWeek on All-in-One WP Migration, SecurityWeek on Forminator.
Leave a Reply