{"uuid": "9db61da4-c06d-4207-bf26-f2d143ae5d5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19949", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mumdfyi3kj2o", "content": "\ud83e\udd16 CVE-2026-19949: 2nd-order SQLi in the All-in-One WP Migration and Backup plugin. Unauth attackers poison trackbacks; SQLi fires during admin restore, leaks the import key -> malicious .wpress -> RCE, full site takeover. ~3.25M sites still\u2026", "creation_timestamp": "2026-09-03T11:20:47.571165Z"}