CVE-2026-6128 in All-in-One WP Migration Unlimited Extension Plugin
Summary
by MITRE • 08/28/2026
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combined with missing authorization checks on the settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin settings page. The vulnerability was partially patched in version 2.84.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The All-in-One WP Migration Unlimited Extension is a widely utilized WordPress plugin designed to facilitate the backup, migration, and restoration of WordPress sites with enhanced capabilities beyond the free version's limitations. A critical security flaw has been identified within this software affecting all versions up to and including 2.84. This vulnerability manifests as a Stored Cross-Site Scripting issue centered on the ai1wm_backups_path parameter. The root cause lies in insufficient input sanitization and output escaping mechanisms when handling user-supplied attributes, compounded by missing authorization checks within the settings function of the plugin's codebase.
From a technical perspective, the vulnerability allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts into stored data fields. Because the injection occurs via a parameter that is processed without adequate validation, malicious payloads can be embedded in the site's configuration or backup path settings. These injected scripts are not executed immediately upon submission but remain dormant within the database until an administrator accesses the plugin's settings page. At this point, the browser renders the stored content and executes the malicious JavaScript code in the context of the administrator's session. This mechanism classifies the flaw as a Stored Cross-Site Scripting vulnerability rather than a reflected one, significantly increasing its potential impact due to persistence across multiple user sessions.
The operational impact of this vulnerability is severe because it leverages low-privilege credentials to achieve high-level compromise. An attacker with Subscriber access, which is often granted to content contributors or editors who may not require deep administrative privileges for their daily tasks, can escalate their influence by targeting administrators. Once the script executes in an administrator's browser session, the attacker gains the ability to perform actions on behalf of that user. This includes modifying site settings, creating new admin accounts, defacing the website, stealing sensitive data such as cookies and authentication tokens, or redirecting users to malicious phishing sites. The persistence of the attack vector means that every time an administrator views the affected page, they are exposed to potential exploitation without their knowledge.
Industry standards categorize this type of flaw under CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting specifically within the Stored variant category. The lack of proper authorization checks aligns with CWE-862 Missing Authorization allowing users to access resources they should not be permitted to modify. Furthermore, in terms of tactical mapping according to MITRE ATT&CK framework this vulnerability supports techniques related to Client-side Injection and potentially Account Manipulation if used to create backdoor accounts or Persistence through stored payloads that trigger on specific user interactions.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. The most effective remediation is to update the All-in-One WP Migration Unlimited Extension plugin to version 2.85 or later where this vulnerability has been partially patched. Developers should ensure that all future updates implement strict input validation using allowlists for expected characters in path parameters and enforce robust output encoding such as HTML entity encoding before rendering user-supplied data in browser contexts. Additionally, implementing role-based access control checks within the settings function is crucial to prevent lower-privilege users from modifying critical configuration fields. Site administrators should also monitor plugin usage logs for unusual activity and regularly audit user permissions to ensure that only necessary individuals have elevated access levels reducing the attack surface available to potential adversaries exploiting this or similar vulnerabilities.