CVE-2026-81810 in All-in-One WP Migration and Backup Plugin
Summary
by MITRE • 09/18/2026
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in versions of the All-in-One WP Migration and Backup plugin prior to version 7.111 represents a critical authentication bypass mechanism rooted in flawed access control logic within its AJAX endpoint handling. The core technical flaw lies in the absence of proper capability checks for several administrative actions, specifically those related to importing site archives. Instead of verifying that the requesting user possesses specific WordPress capabilities such as manage_options or import, the plugin relies solely on a secret key generated during installation. This design choice creates a significant security gap because the secret is disclosed to any user who has been granted permission to export data from the website. Consequently, an attacker with relatively low privileges can leverage this exported information to authenticate administrative actions that should be restricted to high-privilege users only.
From a technical perspective, the exploitation chain begins when a user with export capabilities retrieves the site archive and the associated secret key. Since the import functionality does not validate whether the importer has the necessary WordPress roles or capabilities, it accepts any request containing the valid installation secret. This allows an authenticated but unauthorized user to upload and execute arbitrary PHP code contained within a maliciously crafted site archive. Upon successful import, the attacker gains full administrator access to the WordPress instance, effectively escalating their privileges from a limited role to that of a superuser with complete control over the application's configuration, content, and plugins.
The operational impact of this vulnerability is severe, as it facilitates unauthorized administrative access leading to potential data exfiltration, defacement, or further compromise of the underlying server infrastructure. By gaining administrator rights, an attacker can install backdoors, modify core files, steal sensitive user data including passwords stored in plaintext or weakly hashed formats, and pivot into other systems connected to the WordPress environment. This vulnerability is particularly dangerous because it does not require SQL injection or remote code execution flaws in third-party plugins; instead, it exploits a logical error in how the plugin manages its own internal security boundaries relative to standard WordPress role hierarchies.
In terms of industry standards classification, this issue aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the secret is considered static or predictable across instances, though it more accurately reflects a failure in authorization logic where access is granted based on shared secrets rather than user-specific permissions. Within the MITRE ATT&CK framework for enterprise security, this vulnerability maps to T1078 Valid Accounts and specifically supports lateral movement techniques by allowing an attacker to establish persistent administrative footholds within web application environments. It also relates to T1505.003 Web Shell as the imported archive often contains malicious scripts that execute upon activation or import completion.
Mitigation strategies must prioritize immediate updates to version 7.111 or later, where these capability checks have been implemented correctly. Administrators should ensure that the export capability is not granted to roles that do not already possess high-level administrative privileges within WordPress. If such a configuration exists in legacy systems prior to patching, it is advisable to restrict access to the export functionality through additional security plugins or web application firewall rules until an upgrade can be performed. Regular auditing of user capabilities and plugin configurations remains essential to prevent similar logical flaws from being exploited in other components of the content management system ecosystem.