What is the CVSS score of CVE-2026-5753?

CVE-2026-5753 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

All-in-One WP Migration Unlimited CVE-2026-5753

EUVD-2026-27522 MEDIUM

Missing Authorization (CWE-862)

2026-05-06 Wordfence

GHSA-3qcg-h4xg-5jrg

Authentication Bypass Information Disclosure WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 04:30 vuln.today

DescriptionCVE.org

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not verifying user capabilities before saving schedule data. This makes it possible for authenticated attackers, with subscriber-level access and above, to create scheduled export jobs and send backup notifications to attacker-controlled email addresses. Because such notifications include the random backup filename, full site backups can subsequently be downloaded from the target site, resulting in sensitive information exposure.

AnalysisAI

Missing authorization in All-in-One WP Migration Unlimited Extension for WordPress versions up to 2.83 allows authenticated subscribers to create scheduled export jobs without capability verification, enabling attackers to exfiltrate full site backups by redirecting notifications to attacker-controlled email addresses and leveraging exposed backup filenames for download. This results in complete site data disclosure including sensitive information accessible to low-privilege authenticated users.

Technical ContextAI

The vulnerability exists in the 'Ai1wmve_Schedules_Controller::save' handler registered for the 'admin_post_ai1wm_schedule_event_save' action. The WordPress admin_post action fires for both authenticated and unauthenticated POST requests to wp-admin/admin-post.php, but the handler fails to call current_user_can() or equivalent capability checks before processing schedule data. This is a classic authorization bypass in WordPress plugin development where an action handler assumes capability verification has already occurred upstream. The CWE-862 (Missing Authorization) classification indicates the root cause: the code path that processes user-supplied schedule parameters does not validate whether the user has permission to create scheduled exports. Subscribers, the lowest authenticated user role in WordPress, can trigger this action by crafting direct POST requests to wp-admin/admin-post.php with action=ai1wm_schedule_event_save.

RemediationAI

Upgrade All-in-One WP Migration Unlimited Extension to a patched version immediately; the specific fix version is not provided in available data, so consult the Servmask changelog at https://help.servmask.com/knowledgebase/unlimited-extension-changelog/ to identify the first version after 2.83 containing the authorization fix. The vendor must have released a corrected version that adds proper capability checks (e.g., current_user_can('manage_options')) to the Ai1wmve_Schedules_Controller::save handler. As a temporary workaround pending upgrade, restrict subscriber-level access on production WordPress sites to trusted users only, or use role-management plugins to prevent subscriber account creation entirely if backup scheduling is only needed by administrators. Additionally, implement email filtering to prevent notifications from being redirected to external addresses, and monitor access logs for suspicious calls to wp-admin/admin-post.php?action=ai1wm_schedule_event_save from low-privilege accounts. Note that workarounds do not eliminate the authorization defect; patching is the required fix.