Critical WordPress Plugin Flaw Enables Full Site Takeover via Stored SQL Injection

A newly disclosed vulnerability identified as CVE-2026-19949 could allow attackers without any credentials to hijack WordPress sites by exploiting a stored SQL injection flaw in a widely used plugin, security researchers say.

The flaw, reported by the GBHackers group, affects more than five million active WordPress installations that have the vulnerable plugin enabled. By inserting malicious SQL code into the plugin's database tables, an attacker can execute arbitrary commands on the server, effectively gaining full control of the compromised website.

WordPress powers roughly 43% of all websites on the internet, and its extensible architecture relies heavily on third‑party plugins to add functionality. While this flexibility fuels rapid development, it also creates a large attack surface. Historically, plugin‑related vulnerabilities have been a common entry point for malicious actors, and this latest issue underscores the ongoing risk.

According to the advisory, the vulnerability is classified as high severity because it requires no authentication and can be triggered remotely. Once the malicious payload is stored, the attacker can retrieve it later to run code on the host, potentially installing backdoors, defacing pages, or exfiltrating data. The researchers emphasized that the exploit chain works even against sites that have applied the latest WordPress core updates, as the weakness resides entirely within the plugin's code.

Plugin developers have been urged to release patches immediately. In the meantime, security experts recommend that site administrators disable or remove the affected plugin, apply any available updates, and consider additional safeguards such as web‑application firewalls, database user privilege hardening, and regular security scans. WordPress.org has added a security notice to the plugin's repository, directing users to the upcoming patch.

The discovery adds to a growing list of high‑impact WordPress vulnerabilities disclosed in 2026, prompting calls for a more rigorous review process for plugins submitted to the official marketplace. As the ecosystem continues to expand, experts warn that timely patch management and a layered security approach remain the most effective defenses against attacks of this nature.