All-in-One WP Migration CVE-2026-89064

No special conditions to reach the write path - remote unauthenticated exploitation against default configurations of All-in-One WP Migration and Backup ≤7.110, since Ai1wm_Main_Controller::init() is registered on admin_init which executes for anonymous requests to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php. The credential-HARVESTING variant is materially amplified in environments that use WordPress Application Passwords or HTTP Basic auth for REST API / third-party integrations against /wp-admin/, since those live credentials are then silently captured; the overwrite variant needs only an attacker-chosen Authorization: Basic header. The main LIMIT on real-world impact is that recovering the captured secrets in reversible base64 requires separate read access to the ai1wm_auth_header option (database or backup export), so this alone yields a credential-poisoning/integrity write rather than a direct network-observable disclosure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3 Medium) accurately captures the DIRECTLY reachable capability: an unauthenticated network attacker can trigger the vulnerable write path with no user interaction and low complexity, but the vendor scored only I:L because the attacker's guaranteed primitive is overwriting the stored ai1wm_auth_header option rather than reading arbitrary secrets. The more alarming credential-harvesting angle (silently capturing legitimate Application Passwords / HTTP Basic creds into the DB in reversible base64) is a genuine CWE-522 concern, but realizing that confidentiality impact requires a SECONDARY read primitive (DB/option access via another vuln or backup export), which is why C:N is defensible for THIS finding in isolation - worth noting the score understates aggregate risk when chained. No EPSS score, KEV listing, POC, or SSVC data was supplied, so exploitation must be treated as 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. Net: a real, easily triggerable low-privilege write bug in an extremely widely deployed plugin; prioritize patching due to install base and trivial exploitability, not because of a confirmed high-impact primitive.

An attacker sends an anonymous POST to /wp-admin/admin-ajax.php or /wp-admin/admin-post.php carrying a crafted 'Authorization: Basic' header; because Ai1wm_Main_Controller::init() runs on admin_init (which fires unauthenticated on those endpoints) with no capability, nonce, or login check, the supplied username/password are base64-stored into the ai1wm_auth_header option. Alternatively, the same unauthenticated code path silently harvests real WordPress Application Passwords transmitted as Basic auth by legitimate REST/third-party integrations, banking them in the database in reversible form. No public exploit code is identified at time of analysis.