In this paper, an attack effect observer-based security control (AEOBSC) architecture is developed for cyber-physical systems (CPSs) subject to false data injection attack (FDIA). The physical system of CPSs is modeled as a class of nonlinear systems. The FDIA is injected into the control channel by the attacker over the wireless network. In order to approximate the actual cyber-attack effect, the abnormal dynamics triggered by FDIA are modeled as a kind of time-derivative bounded abnormal effect. The attack effect observer is designed to estimate the abnormal attack effect. Based on the estimation signal, the attack effect observer-based security control architecture is established such that the abnormal attack effect can be rejected and the uniformly ultimately bounded performance can be guaranteed. Finally, the A4D aircraft simulation experiment is established to verifies the effectiveness of the proposed security control architecture.