What is the CVSS score of EUVD-2026-59911?

EUVD-2026-59911 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-59911?

Yes, a public proof-of-concept exploit is available for EUVD-2026-59911. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-59911?

Within 24 hours, conduct an inventory of all WordPress multisite installations using the All-in-One WP Migration and Backup plugin and identify those running versions prior to 7.108. Within 7 days, update all affected installations to version 7.108 or later through the WordPress plugin update mechanism or directly from the vendor. Within 30 days, review WordPress administrative access logs for suspicious activity from subsite administrator accounts during the vulnerable exposure period, audit recent migration and backup operations for unauthorized changes, and verify that network-level access controls properly restrict migration import features to network administrators only.

All-in-One WP Migration EUVD-2026-59911

Q: Which versions of All-in-One WP Migration are affected by EUVD-2026-59911?

The All-in-One WP Migration and Backup plugin (versions prior to 7.108) on WordPress multisite networks contains a privilege escalation flaw allowing lower-level site administrators to execute…. A patch is available.

| CVE-2026-17533 HIGH

Improper Privilege Management (CWE-269)

2026-08-16 WPScan

GHSA-qgjj-8h65-3vcm

PHP WordPress Privilege Escalation All In One Wp Migration And Backup Unknown

7.2

CVSS 3.1 · Vendor: WPScan

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain subsite administrator credentials
Delivery

Log into WordPress multisite subsite dashboard
Exploit

Craft malicious migration archive containing PHP payload
Execution

Submit archive via plugin's unrestricted migration import endpoint
Impact

PHP payload executes across entire WordPress network

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires all of the following: (1) a WordPress multisite installation - standard single-site WordPress is not affected under any circumstances; (2) All-in-One WP Migration and Backup plugin installed at a version prior to 7.108; (3) the attacker must hold authenticated subsite administrator credentials (CVSS PR:H) - unauthenticated exploitation is not possible. The limiting factors are significant: the multisite deployment mode is less common than standard WordPress, the attacker must already have subsite admin access, and SSVC flags this as non-automatable. Organizations where subsite admin roles are granted to trusted internal staff face lower realized risk than those granting this role to external clients or tenants.
Impact	The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) correctly reflects the high-privilege prerequisite (PR:H) while noting full CIA impact. The PR:H designation here maps to subsite administrator access - a meaningful credential barrier that limits opportunistic exploitation. EPSS at 0.14% (4th percentile) is notably low, suggesting that despite POC availability this is not being exploited broadly. SSVC rates Technical Impact as 'total' but Automatable as 'no', meaning mass exploitation is not feasible and attacks require per-target effort. The real-world risk is focused: organizations running WordPress multisite with this plugin and granting subsite administrator access to untrusted or semi-trusted users face meaningful risk, as those users could escalate to full network code execution. Single-site WordPress installations are entirely unaffected. The combination of POC existence and total technical impact warrants prompt patching despite the low EPSS.
Exploit ScenarioDerived	An attacker with subsite administrator credentials on a WordPress multisite network crafts a malicious migration archive embedding a PHP webshell or backdoor, then triggers the plugin's migration import function - which improperly permits subsite admins to invoke this network-level operation. The PHP payload executes server-side with network-wide scope, granting the attacker persistent code execution across all subsites. A publicly available proof-of-concept exists per WPScan, lowering the technical bar for this attack.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.

RemediationAI

Upgrade the All-in-One WP Migration and Backup plugin to version 7.108 or later, which contains the vendor-released patch addressing the access control deficiency. For multisite installations that cannot immediately apply the update, network administrators should audit and minimize the list of users holding subsite administrator roles, particularly for subsites managed by untrusted or external parties, since those accounts represent the exploitation vector. Disabling the migration import feature at the network level - if the plugin exposes a network-level toggle - is an effective compensating control with the trade-off of blocking legitimate migration operations. The WPScan advisory at https://wpscan.com/vulnerability/13b57cdc-d954-4db6-94c2-53ad04ab0d34/ should be consulted for vendor-specific guidance.

Affected VersionsENISA

All-in-One WP Migration and Backup 0 <7.108

Affected Packages

euvd all_in_one_wp_migration_and_backup fix: 7.108

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WordPress Multisite is a deployment mode that allows a single WordPress installation to host multiple subsites, with a tiered privilege model separating network administrators (who control the entire installation) from subsite administrators (who control only their assigned site). The All-in-One WP Migration and Backup plugin (CPE: cpe:2.3:a:unknown:all-in-one_wp_migration_and_backup:*:*:*:*:*:*:*:*) provides functionality to import migration archives - packages that can contain arbitrary PHP files deployed to the server. CWE-269 (Improper Privilege Management) is the root cause: the plugin fails to verify that the user triggering a migration import holds network administrator authority rather than merely subsite administrator authority. This conflation of privilege levels allows the less-privileged role to invoke a network-scoped, code-execution-capable operation.

Know when PHP gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (WPScan) PRIMARY 7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.2 HIGH

Network-reachable WordPress dashboard (AV:N), subsite admin credentials required (PR:H), no interaction needed, and arbitrary PHP execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 21:22 NVD

7.2 (None) 7.2 (HIGH)

Patch available

Aug 16, 2026 - 07:01 EUVD

CVE Published

Aug 16, 2026 - 06:00 cve.org

HIGH 7.2

CVE Published

Aug 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.

Executive ViewAI

Why It Matters

The All-in-One WP Migration and Backup plugin (versions prior to 7.108) on WordPress multisite networks contains a privilege escalation flaw allowing lower-level site administrators to execute arbitrary PHP code across the entire network. Organizations using this plugin in multisite deployments face risk of unauthorized data access, malware injection, or complete network compromise by potentially compromised or malicious site administrators.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 96% exploitable

Prevalence

Medium

Popular WordPress migration plugin, but multisite-only exploitation scope

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.