News Roundup: August 27–September 6, 2026

A quieter week than the last one, but still a few things worth patching for: a fresh WordPress migration-plugin bug with a genuinely clever exploit chain, a MikroTik security release that’s light on details, and a heavy batch of critical Cisco advisories.

• All-in-One WP Migration and Backup patches a second-order SQL injection (CVE-2026-19949, CVSS 8.8) affecting over 3 million sites. The exploit chain is worth knowing about even if you don’t run this plugin: an attacker submits two trackbacks containing a trailing backslash and a payload URL, which the plugin fails to sanitize; once an admin exports and re-imports a site archive, that unsanitized input gets promoted into executable SQL, leaking the plugin’s secret key into a public comment. From there, an unauthenticated attacker can import a crafted archive containing a malicious must-use plugin for full RCE. Multi-step, but entirely unauthenticated end to end.
• MikroTik shipped RouterOS 7.24.2 (stable/testing), 7.23.4 (long-term), and 6.49.21 (legacy) on September 3 as “important security updates,” deliberately withholding vulnerability details for now to give admins time to patch. Worth noting: this release adds a “Flagged” device status that RouterOS will set automatically if it detects your device has already been compromised, check your Log for it after updating. Regardless of what the underlying bug turns out to be, this is a good week to confirm Winbox, SSH, and HTTP management access are firewalled to trusted hosts only.
• Cisco’s September 2 advisory batch included two critical (CVSS 9.8) issues worth flagging if you’re running the affected gear: an IOS XR security hardening release covering seven CVEs, and a Nexus 9000 Series Silicon One remote code execution bug (CVE-2026-20212). Neither is reported as exploited in the wild yet, but a 9.8 on core routing/switching platforms isn’t one to defer.
• WordPress 7.1.1 is scheduled as a bug-fix-only maintenance release for September 17, with RC1 landing September 10. No security fixes listed so far, so it’s a lower-priority update than the plugin issue above, but worth having on the calendar for the current WP 7.1 stack.