TECH NEWS

Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

A high-severity vulnerability in the All-in-One WP Migration and Backup WordPress plugin exposes over 3 million websites to remote code execution (RCE) attacks, WordPress security firm Defiant warns.

Tracked as CVE-2026-19949 (CVSS score of 8.8), the security defect is described as a second-order SQL injection issue in the archive restore functionality of the plugin.

The flaw exists because user-supplied input is insufficiently escaped and existing SQL queries are not sufficiently prepared, Defiant explains.

An attacker could supply malicious content via WordPress core’s trackback functionality to extract the secret key used during an archive restore operation, and then use the key to deploy a malicious plugin for RCE.

All-in-One WP Migration and Backup packages sites into .wpress archives and allows admins to restore the archive on any destination server. The import operation is unauthenticated, but protected using a secret key that is saved during each database-restore pass.

CVE-2026-19949 allows an...

Copyright of this story solely belongs to securityweek.com. To see the full text click HERE

https://platform.theverge.com/wp-content/uploads/sites/2/2026/07/268670_Framework_Laptop_13_Pro_laptop_review_ADiBenedetto_0003.jpg?quality=90&strip=all&crop=0%2C10.732984293194%2C100%2C78...

Framework is giving some customers a RAM refund

Framework says it found a “limited quantity” of lower-cost RAM for the Laptop 13 Pro that it’s offering to existing preorder customers first. by Stevie Bonifield Sep 9, 2026, 3:36 PM UTC Photo: Antonio G. Di Benedetto / The Verge Stevie Bonifield is a news writer covering all things

https://image.theregister.com/241371.jpg?imageId=241371&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683

Cryptocrook ringleader, 22, who met crew on Minecraft admits role in $245M heist

Stolen funds bought mansions, private jets, and supercars – now he faces up to 20 years The ringleader of a sprawling cybercrime operation has pleaded guilty in the US after helping to steal and launder hundreds of millions of dollars in cryptocurrency. Malone Lam, 22, a Singaporean national and Miami resident,

https://image.theregister.com/227651.jpg?imageId=227651&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683

UK government says Fujitsu won't use framework places to chase new customers

PUBLIC SECTOR Procurement officials promise to police the scandal-hit supplier's voluntary bidding moratorium The UK government has told MPs that Fujitsu has promised not to pursue contracts with new public sector customers through frameworks potentially worth billions of pounds while its voluntary bidding moratorium remains in place. In

https://cdn.mos.cms.futurecdn.net/U76sZeRd6fS2fKt5RqBYPL-2560-80.jpg

NordVPN warns AI is making scams more personal and devastating than ever

* NordVPN blocked over 5 million malware attempts in January alone * 99% of phishing attacks impersonate just 300 brands * AI tools and fraud kits mean attackers no longer need advanced skills We are well past the days when a cyberattack meant mass-mailing a poorly spelled virus. In 2026, cybercriminals are heavily

Read more

Framework is giving some customers a RAM refund

Cryptocrook ringleader, 22, who met crew on Minecraft admits role in $245M heist

UK government says Fujitsu won't use framework places to chase new customers

NordVPN warns AI is making scams more personal and devastating than ever