All-in-One WP Migration Unlimited EUVD-2026-27522

The attacker must possess valid WordPress subscriber-level credentials (username and password) or an active session cookie for a subscriber account. The All-in-One WP Migration Unlimited Extension must be installed and activated on the target WordPress site. The site must not have implemented supplementary capability checks via custom code, alternative security plugins, or role-restriction measures. The backup notifications must be sent to an email address attacker can access or monitor. No special plugin configuration, non-default settings, or additional privileges beyond subscriber role are required; the vulnerability exists in the default installation. Exploitation is limited by the requirement for pre-existing authentication-unauthenticated attackers cannot directly exploit this vulnerability, and sites with strict user registration policies (closed registration or admin-only accounts) have reduced exposure.

CVSS 6.5 (Medium-High) reflects the attack vector (network-accessible), low complexity (no special conditions), low privilege requirement (authenticated subscriber), and high confidentiality impact (full site backup exposure). However, exploitation requires authentication-a subscriber account must already exist and the attacker must possess valid credentials or compromise a low-privilege account. EPSS and KEV status are not provided in input data, so real-world exploitation frequency is unconfirmed. The practical risk is substantial for multi-tenant WordPress hosting environments where subscriber accounts are abundant or easily created, but lower for tightly controlled enterprise deployments with restricted user registration. The attack is not complex: once authenticated, an attacker automates schedule creation, intercepts notifications at attacker-controlled email, and downloads backups using exposed filenames. No interaction by legitimate users is required post-authentication. The limiting factor-requirement for valid subscriber credentials-significantly reduces exposure compared to unauthenticated vulnerabilities, yet the impact (full site backup) justifies prioritization. Organizations with open user registration face higher risk than those with invited-only or administratively-managed user bases.

An attacker creates or compromises a subscriber-level WordPress account on a target site. The attacker sends a crafted POST request to wp-admin/admin-post.php with action=ai1wm_schedule_event_save and parameters specifying a backup schedule and attacker-controlled email address. The plugin creates the schedule without verifying the subscriber has backup-creation permissions, and sends a test or scheduled notification to the attacker's email containing the randomly-generated backup filename. The attacker downloads the full site backup from a publicly or privately accessible location using the exposed filename, obtaining the complete WordPress database, configuration files, and user credentials.