WP Migration Unlimited CVE-2026-6128

The target site must run All-in-One WP Migration Unlimited Extension version 2.84 or earlier. The attacker must hold a valid WordPress account with at minimum Subscriber-level access - the lowest authenticated WordPress role. On sites with open user registration (Settings > General > Membership enabled), this barrier is trivially low as anyone can self-register without prior access. On sites with closed registration, the attacker must first obtain or compromise a subscriber-level credential. Exploitation is further gated on a site administrator actively navigating to the plugin settings page after payload injection; if no administrator visits that page, the stored payload does not execute despite being present in the database. The CVSS PR:L vector confirms authentication is required; unauthenticated exploitation is not possible.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) rates this as Medium severity, with the scope-changed designation (S:C) reflecting cross-privilege escalation from subscriber to administrator context. However, the UI:N assignment is in direct tension with the description, which states the payload fires only when an administrator accesses the plugin settings page - a more accurate assignment would be UI:R, reducing the base score and better representing actual exploitation timing. No EPSS data was included in the available intelligence, preventing probabilistic exploitation forecasting. The absence of a KEV listing and the lack of any identified public exploit code indicate this is not under active mass exploitation at time of analysis. Real-world priority is moderate: the chief risk is session hijacking or unauthorized admin-account creation on WordPress sites with open user registration, where the Subscriber-level prerequisite is a trivially low barrier. On sites with closed registration the attack path requires prior account compromise, substantially narrowing the realistic threat surface.

An attacker self-registers a Subscriber account on a WordPress site with open user registration enabled, then sends a crafted POST request to the settings() function embedding a JavaScript payload in the ai1wm_backups_path parameter; no elevated privileges are required beyond a valid subscriber session. The malicious value is stored in the WordPress database without sanitization. When a site administrator next navigates to the plugin's settings page, the stored script executes in their authenticated browser context, enabling session cookie theft or silent creation of a rogue administrator account.