Aruba Migration Tool EUVD-2026-90857

Requires (1) a WordPress site running the Aruba Migration Tool plugin at version <= 1.0.4, and (2) the attacker holding a valid authenticated account at subscriber level or higher (PR:L). No user interaction and no special non-default configuration are indicated beyond having the plugin installed and active. Exploitation is limited by the authentication requirement - self-registration must be open or the attacker must otherwise obtain a low-privilege account - and by the plugin's niche deployment; impact is confined to confidentiality (data disclosure), with no integrity or availability effect.

Moderate-but-constrained risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 MEDIUM) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction, yielding high confidentiality impact with zero integrity or availability impact - a pure information-disclosure/broken-access-control issue. The CWE-862 (Missing Authorization) classification is consistent with the 'Subscriber Broken Access Control' description: any authenticated subscriber-level account can reach data the migration tool should restrict to admins. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The PR:L gate (attacker needs a valid low-privilege account) and the plugin's niche footprint substantially temper real-world risk versus the raw 6.5; this is a genuine access-control bug worth patching on affected sites, not an internet-wide emergency. Note a signal conflict: the Tag 'Authentication Bypass' contradicts the CWE-862 authorization classification and the PR:L vector (exploitation requires authentication, not a bypass of it) - treat the tag as mislabeled.

An attacker registers or obtains a low-privilege subscriber account on a WordPress site running Aruba Migration Tool <= 1.0.4, then directly invokes the plugin's migration/export endpoints which fail to enforce an authorization (capability) check. Because the endpoint lacks a role gate, the subscriber retrieves sensitive site/migration data (e.g., exported content or configuration) that should be admin-only. No public POC is referenced, and exploitation requires a valid authenticated account.