ServMask All-in-One WP Migration and Backup Plugin up to 7.110 on WordPress admin-ajax.php init PHP_AUTH_USER/PHP_AUTH_PW insufficiently protected credentials

Summaryinfo

A vulnerability was found in ServMask All-in-One WP Migration and Backup Plugin up to 7.110. It has been rated as critical. This affects the function Ai1wm_Main_Controller::init of the file admin-ajax.php. Performing a manipulation of the argument PHP_AUTH_USER/PHP_AUTH_PW results in insufficiently protected credentials. This vulnerability is reported as CVE-2026-89064. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in ServMask All-in-One WP Migration and Backup Plugin up to 7.110. This affects the function Ai1wm_Main_Controller::init of the file admin-ajax.php. The manipulation of the argument PHP_AUTH_USER/PHP_AUTH_PW with an unknown input leads to a insufficiently protected credentials vulnerability. CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method — registered on the `admin_init` hook, which fires unauthenticated on `admin-ajax.php` and `admin-post.php` requests — reading `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writing them to the `ai1wm_auth_header` option via `update_option()` as a reversible base64-encoded string, with no capability check, nonce verification, `is_user_logged_in()` check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture into the database, in reversible base64 form, any WordPress Application Password or HTTP Basic credential presented to `/wp-admin/` by a legitimate integration, or to overwrite the stored credential with an attacker-chosen value by sending an anonymous request carrying a crafted `Authorization: Basic` header. This is particularly impactful in environments using WordPress Application Passwords for REST API or third-party integrations, as those credentials are transmitted as HTTP Basic auth to `/wp-admin/` and will be silently harvested via this unauthenticated write path.

It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2026-89064 since 09/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026). The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

By approaching the search of inurl:admin-ajax.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• ServMask

Name

• All-in-One WP Migration and Backup Plugin

Version

• 7.110

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion