{"uuid": "25fb16f8-b75d-4058-9c0c-a39097dd9ccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19949", "type": "seen", "source": "https://t.me/pphm_HackerNews/2986", "content": "\ud83d\udd34 Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability\n\nA high-severity vulnerability in the All-in-One WP Migration and Backup WordPress plugin exposes over 3 million websites to remote code execution (RCE) attacks, WordPress security firm Defiant warns.\n\nTracked as CVE-2026-19949 (CVSS score of 8.8), the security defect is described as a second-order SQL injection issue in the archive restore functionality of the plugin.\n\nThe flaw exists because user-supplied input is insufficiently escaped and existing SQL queries are not sufficiently prepared, Defiant explains.", "creation_timestamp": "2026-09-04T00:00:18.942622Z"}