EUVD-2026-27522
GHSA-3qcg-h4xg-5jrg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
1DescriptionCVE.org
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not verifying user capabilities before saving schedule data. This makes it possible for authenticated attackers, with subscriber-level access and above, to create scheduled export jobs and send backup notifications to attacker-controlled email addresses. Because such notifications include the random backup filename, full site backups can subsequently be downloaded from the target site, resulting in sensitive information exposure.
AnalysisAI
Missing authorization in All-in-One WP Migration Unlimited Extension for WordPress versions up to 2.83 allows authenticated subscribers to create scheduled export jobs without capability verification, enabling attackers to exfiltrate full site backups by redirecting notifications to attacker-controlled email addresses and leveraging exposed backup filenames for download. This results in complete site data disclosure including sensitive information accessible to low-privilege authenticated users.
Technical ContextAI
The vulnerability exists in the 'Ai1wmve_Schedules_Controller::save' handler registered for the 'admin_post_ai1wm_schedule_event_save' action. The WordPress admin_post action fires for both authenticated and unauthenticated POST requests to wp-admin/admin-post.php, but the handler fails to call current_user_can() or equivalent capability checks before processing schedule data. This is a classic authorization bypass in WordPress plugin development where an action handler assumes capability verification has already occurred upstream. The CWE-862 (Missing Authorization) classification indicates the root cause: the code path that processes user-supplied schedule parameters does not validate whether the user has permission to create scheduled exports. Subscribers, the lowest authenticated user role in WordPress, can trigger this action by crafting direct POST requests to wp-admin/admin-post.php with action=ai1wm_schedule_event_save.
RemediationAI
Upgrade All-in-One WP Migration Unlimited Extension to a patched version immediately; the specific fix version is not provided in available data, so consult the Servmask changelog at https://help.servmask.com/knowledgebase/unlimited-extension-changelog/ to identify the first version after 2.83 containing the authorization fix. The vendor must have released a corrected version that adds proper capability checks (e.g., current_user_can('manage_options')) to the Ai1wmve_Schedules_Controller::save handler. As a temporary workaround pending upgrade, restrict subscriber-level access on production WordPress sites to trusted users only, or use role-management plugins to prevent subscriber account creation entirely if backup scheduling is only needed by administrators. Additionally, implement email filtering to prevent notifications from being redirected to external addresses, and monitor access logs for suspicious calls to wp-admin/admin-post.php?action=ai1wm_schedule_event_save from low-privilege accounts. Note that workarounds do not eliminate the authorization defect; patching is the required fix.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today