WordPress All-in-One WP Migration Plugin <= 7.86 is vulnerable to Sensitive Data Exposure<\/p>
Software: All-in-One WP Migration<\/p>
Link: https:\/\/wordpress.org\/plugins\/all-in-one-wp-migration\/#developers<\/p>
Affected Version <= 7.86<\/p>
Fixed in version 7.87 <\/p>","date":"2024-10-21"},{"id":"1b946fc2f7aabb298b7ac9b8a1c952b10dd2c17a","name":"All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-wp-migration\/all-in-one-wp-migration-and-backup-786-unauthenticated-information-disclosure-via-error-logs","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full paths contained in the exposed log files.","date":"2024-10-21"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"b4ae3c5a9261415e0c74baad9ad34668f426c6af3e31e0dbf86722e6e792eb36","name":"All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.87","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"7.87","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-9162","name":"CVE-2024-9162","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9162","description":"[en] The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site's server, adding an arbitrary PHP code to it, which may make remote code execution possible.","date":"2024-10-28"},{"id":"8d6574fc558e3a1cf1d4c66b1a949d698afb1018","name":"All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-wp-migration\/all-in-one-wp-migration-and-backup-786-authenticated-administrator-arbitrary-php-code-injection","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site's server, adding an arbitrary PHP code to it, which may make remote code execution possible.","date":"2024-10-27"},{"id":"0210dcc8ae1d7fbd536bb7a12096645b9e1e159e","name":"WordPress All-in-One WP Migration Plugin <= 7.86 is vulnerable to PHP Object Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-wp-migration\/vulnerability\/wordpress-all-in-one-wp-migration-and-backup-plugin-7-86-authenticated-administrator-arbitrary-php-code-injection-vulnerability","description":"
WordPress All-in-One WP Migration Plugin <= 7.86 is vulnerable to PHP Object Injection<\/p>
Software: All-in-One WP Migration<\/p>
Link: https:\/\/wordpress.org\/plugins\/all-in-one-wp-migration\/#developers<\/p>
Affected Version <= 7.86<\/p>
Fixed in version 7.87 <\/p>","date":"2024-10-28"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"h","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"7.2","severity":"h","exploitable":"1.2","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"7.2","severity":"high","av":"network","ac":"low","pr":"high","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"1.2","impact":"5.9"},"cwe":[{"cwe":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"0b111b4b8c5b511acef979a372a4a846407bc2ef6911eb61067002680c8a1518","name":"All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.90","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"7.90","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-10942","name":"CVE-2024-10942","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-10942","description":"[en] The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 via deserialization of untrusted input in the 'replace_serialized_values' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must export and restore a backup in order to trigger the exploit.","date":"2025-03-13"},{"id":"a9c5dffcad7b182e4a4dc22a77b6010803f7f710","name":"WordPress All-in-One WP Migration Plugin <= 7.89 is vulnerable to PHP Object Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/all-in-one-wp-migration\/vulnerability\/wordpress-all-in-one-wp-migration-plugin-7-89-unauthenticated-php-object-injection-vulnerability","description":"
WordPress All-in-One WP Migration Plugin <= 7.89 is vulnerable to PHP Object Injection<\/p>
Software: All-in-One WP Migration<\/p>
Fixed in version 7.90 <\/p>
Affected Version <= 7.89<\/p>
CVE: CVE-2024-10942<\/p>","date":"2025-03-13"},{"id":"368ea946d0cd233b714bbf5c914f63d95fa383a6","name":"All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-wp-migration\/all-in-one-wp-migration-789-unauthenticated-php-object-injection","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 via deserialization of untrusted input in the 'replace_serialized_values' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must export and restore a backup in order to trigger the exploit.","date":"2025-03-12"},{"id":"EUVD-2025-6287","name":"EUVD-2025-6287","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-6287","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 via deserialization of untrusted input in the 'replace_serialized_values' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must export and restore a backup in order to trigger the exploit.","date":"2025-03-13"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"h","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"7.5","severity":"h","exploitable":"1.6","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"7.5","severity":"high","av":"network","ac":"high","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"1.6","impact":"5.9"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null},"epss":"0.002"}},{"uuid":"96a3700e6d6612acd7c657379176f2d2721867fa56bad14762c4f0a7eb333efb","name":"All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.98","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"7.98","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-8490","name":"All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-8490","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"0000-00-00"},{"id":"264bb807029a4d98692113167142ee88c4322b10","name":"All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-wp-migration\/all-in-one-wp-migration-and-backup-797-authenticated-administrator-stored-cross-site-scripting-via-import","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2025-08-26"},{"id":"EUVD-2025-25952","name":"EUVD-2025-25952","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-25952","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2025-08-26"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"4.4","severity":"medium","av":"network","ac":"high","pr":"high","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":null,"impact":null}}},{"uuid":"41e26d0095376e517b7b85f4e27caf95ce5c1f8b6d28f45fc936969090a15321","name":"All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.106","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"7.106","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-12898","name":"CVE-2026-12898","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-12898","description":"[en] The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.","date":"2026-07-20"},{"id":"b248dc48351a91df68828d49e5a9676ea40e59be","name":"All-in-One WP Migration and Backup <= 7.105 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/95cb607f-f110-416b-b9e4-87a68710f230","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.105. This makes it possible for unauthenticated attackers to write logs to an arbitrary location.","date":"2026-06-29"}],"impact":{"cwe":[{"cwe":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."}]}},{"uuid":"e776cd070b49342f972583e4bc2c7d072520a548f9005830aec15e7fff5fa207","name":"All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.108","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"7.108","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-17533","name":"CVE-2026-17533","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-17533","description":"[en] The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.","date":"2026-08-16"},{"id":"6c2489b5da62053b261a3a6eab4a90fef2d40fd2","name":"All-in-One WP Migration and Backup < 7.108 - Authenticated (Administrator+) Remote Code Execution","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-wp-migration\/all-in-one-wp-migration-and-backup-7108-authenticated-administrator-remote-code-execution","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to 7.108. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary code on the server.","date":null}],"impact":{"cwe":[{"cwe":"CWE-269","name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"f44b48a1d911b1b619682eb6f18f9a6e04a5527ec88113f635441984435488d4","name":"All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.110","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"7.110","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-19949","name":"CVE-2026-19949","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-19949","description":"[en] The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.","date":"2026-08-25"},{"id":"ae90dc8e4013d0baa297dfb7f916c3b820d30cfd","name":"All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-wp-migration\/all-in-one-wp-migration-and-backup-7109-unauthenticated-second-order-sql-injection-via-archive-restore-to-remote-code-execution","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.","date":"2026-08-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"1c96ad6f61edd8e8776edd24321eaea3e4a14907e21fc9a94b8e86a31ab06bd0","name":"All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.111","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"7.111","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-89064","name":"CVE-2026-89064","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-89064","description":"[en] The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method \u2014 registered on the `admin_init` hook, which fires unauthenticated on `admin-ajax.php` and `admin-post.php` requests \u2014 reading `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writing them to the `ai1wm_auth_header` option via `update_option()` as a reversible base64-encoded string, with no capability check, nonce verification, `is_user_logged_in()` check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture into the database, in reversible base64 form, any WordPress Application Password or HTTP Basic credential presented to `\/wp-admin\/` by a legitimate integration, or to overwrite the stored credential with an attacker-chosen value by sending an anonymous request carrying a crafted `Authorization: Basic` header. This is particularly impactful in environments using WordPress Application Passwords for REST API or third-party integrations, as those credentials are transmitted as HTTP Basic auth to `\/wp-admin\/` and will be silently harvested via this unauthenticated write path.","date":"2026-09-17"},{"id":"85d81b609afcb73679a8c3089dbd20fed0583f74","name":"All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-wp-migration\/all-in-one-wp-migration-and-backup-7110-unauthenticated-insufficient-credential-protection-via-authorization-basic-header","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method \u2014 registered on the `admin_init` hook, which fires unauthenticated on `admin-ajax.php` and `admin-post.php` requests \u2014 reading `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writing them to the `ai1wm_auth_header` option via `update_option()` as a reversible base64-encoded string, with no capability check, nonce verification, `is_user_logged_in()` check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture into the database, in reversible base64 form, any WordPress Application Password or HTTP Basic credential presented to `\/wp-admin\/` by a legitimate integration, or to overwrite the stored credential with an attacker-chosen value by sending an anonymous request carrying a crafted `Authorization: Basic` header. This is particularly impactful in environments using WordPress Application Passwords for REST API or third-party integrations, as those credentials are transmitted as HTTP Basic auth to `\/wp-admin\/` and will be silently harvested via this unauthenticated write path.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"5.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-522","name":"Insufficiently Protected Credentials","description":"The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and\/or retrieval."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"e178f0cbb0f0001c19ef93cc394b12cde10b5096e2365d53356c2dc2de2b09f0","name":"All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.111","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"7.111","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-81810","name":"CVE-2026-81810","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-81810","description":"[en] The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.","date":"2026-09-18"},{"id":"523b607790f2eed5a38cb2c7ca0e1fabecdae938","name":"All-in-One WP Migration and Backup <= 7.110 - Authenticated (Admin+) Privilege Escalation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/all-in-one-wp-migration\/all-in-one-wp-migration-and-backup-7110-authenticated-admin-privilege-escalation","description":"The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.110. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attackers, with admin-level access and above, to elevate their privileges beyond those intended for their role.","date":"2026-09-16"}],"impact":{"cwe":[{"cwe":"CWE-269","name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}}]},"updated":"1790138287"}