EUVD-2026-65463
GHSA-wgw6-99h6-924c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:N per description's 'unauthenticated attackers'; AC:H and UI:R because key extraction is conditioned on an admin actively performing a restore, adding an exploitation precondition.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.
AnalysisAI
SQL injection in the All-in-One WP Migration and Backup plugin (servmask, versions through 7.109) enables a two-stage attack path culminating in remote code execution. Insufficient parameterization in the archive restore database layer allows attackers to append arbitrary SQL queries and exfiltrate the ai1wm_secret_key from the WordPress database; once obtained, this key unlocks the plugin's restore endpoint and enables RCE. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The SQL injection is triggered through user-supplied parameters processed during an archive restore operation using the All-in-One WP Migration and Backup plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, score 8.8) contains an internal conflict with the vulnerability description: the description explicitly states 'unauthenticated attackers' can exploit the flaw - corresponding to PR:N - while the vector specifies PR:L (low privileges). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the All-in-One WP Migration and Backup plugin immediately to a version beyond 7.109. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress installations running All-in-One WP Migration versions 7.109 or earlier and immediately disable the plugin; if restoration capabilities are currently needed, limit access to trusted administrator accounts only and increase monitoring of database and file operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite i
Path traversal in the All-in-One WP Migration and Backup WordPress plugin (versions 7.87 through 7.105) allows unauthent
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today