Second-order SQL injection

All-in-One WP Migration runs the attacker's stored SQL while rewriting URLs on restore

CVE-2026-19949 sits in the read path, so text planted through trackbacks becomes a live query the moment an administrator exports or restores a backup. The query it runs hands over the key that guards the import endpoint.