The vulnerability is an unauthenticated second‑order SQL injection in the archive restore feature of All‑in‑One WP Migration and Backup versions up to 7.109. The flaw arises from insufficient escaping of user‑supplied input and failure to properly prepare the existing SQL statement. An attacker who does not have site privileges can inject additional SQL statements that the plugin then executes as part of the restore process. The injected statements can read sensitive configuration values such as the ai1wm_secret_key; once the key is in hand, an attacker can impersonate an administrator and execute arbitrary code on the server. This results in full remote code execution and total loss of confidentiality, integrity, and availability for the affected WordPress site.

This issue affects the WordPress plugin All‑in‑One WP Migration and Backup, version 7.109 and all earlier releases. The plugin is distributed through the official WordPress Plugin Repository under the vendor servmask. Any WordPress installation that uses any of these legacy plugin versions and allows the archive restore operation is potentially exposed.

The scored CVSS of 8.8 indicates high severity. The plugin runs in a widely used CMS and the library accepts file uploads that can be controlled by remote users attempting a restore. Likely attack vector is through the restore endpoint accessible over the public internet. Because the vulnerability requires no authentication, an attacker can hit the restore endpoint from anywhere, exploiting the flaw if the site has enabled the restore feature. The EPSS score is not listed, but the lack of authentication and the path through the restore process raise the likelihood of exploitation. The flaw is not currently included in CISA's KEV catalog, but the high CVSS and broad exposure suggest a substantial risk for organizations relying on this plugin.