All-in-One WP Migration CVE-2026-81810

Exploitation is NOT possible against a default install. It requires that an administrator has previously granted the plugin's export capability to a role that does NOT also hold the plugin's import capability; the export-capable user is then handed the installation-wide secret, which the vulnerable AJAX import actions accept in lieu of any capability check. Limiting factors: the attacker must already be an authenticated user (PR present in the CVSS vector), the specific delegated-role configuration is non-default and must be present, and the target site must run a version before 7.111. No user interaction is needed once those conditions hold (UI:N).

This is a real but tightly-gated privilege-escalation flaw. All signals are consistent that impact is severe (full administrator takeover via arbitrary site-archive import → C:H/I:H/A:H), and a public POC from WPScan plus a vendor patch (7.111) confirm the issue is real and reproducible. However, the effective risk is materially lower than the 7.2 CVSS suggests because the description explicitly states exploitation is NOT possible in a default configuration: an administrator must first have granted the plugin's export capability to a role that lacks the plugin's import capability. That non-default prerequisite is a condition beyond the attacker's control, so the vendor's AC:L is arguably understated (AC:H is more accurate). Conversely, the vendor's PR:H is arguably overstated - the attacker is a non-admin user holding only the export capability, closer to PR:L. No EPSS score and no CISA KEV listing are present in the input, and there is no evidence of active exploitation - the public exploit code is a distinct signal from in-the-wild use. Net: prioritize patching for sites that use delegated/custom roles, but this is not a mass-exploitation, default-config internet-wide threat.

On a site where an administrator has delegated the plugin's export capability to a lower-privileged custom role (e.g., a site-manager or backup-operator role) without also granting import rights, that user reads the installation-wide secret the plugin discloses to export-capable users, then replays it to the uncapability-checked import AJAX action to upload and restore an attacker-crafted site archive, seizing administrator access. A public POC exists (WPScan), and the attack is remote and requires no user interaction, but it only works against this specific non-default role configuration.