All-in-One WP Migration and Backup Plugin Vulnerability (CVE-2026-89064)

Security Alert Summary

The All-in-One WP Migration and Backup plugin for WordPress contains an insufficient credential protection vulnerability that can allow unauthenticated requests to write HTTP Basic or WordPress Application Password data into the plugin option ai1wm_auth_header in reversible base64 form. The issue stems from the plugin reading authentication headers and persisting them without verifying authentication or user capabilities.

CVE Details

• CVE ID: CVE-2026-89064
• Affected component: All-in-One WP Migration and Backup plugin for WordPress
• Affected versions: Versions up to and including 7.110
• Published: September 17, 2026 at 03:16:32 AM UTC
• Last modified: September 17, 2026 at 03:16:32 AM UTC
• CVSS v3.1 base score: 5.3
• CVSS severity: MEDIUM
• CVSS vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Authentication / privileges / interaction:
  • Privileges required: NONE
  • User interaction: NONE
  • Attack vector: NETWORK
  • Attack complexity: LOW
• Primary impact:
  • Confidentiality: NONE (per CVSS)
  • Integrity: LOW (unauthenticated write of credential data to option)
  • Availability: NONE
• Weakness (CWE): CWE-522

Technical Details

The vulnerability is caused by the plugin method Ai1wm_Main_Controller::init(), which is registered on the admin_init hook. The admin_init hook fires on requests to admin-ajax.php and admin-post.php even when the requester is not authenticated. The init method reads $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] from incoming requests and calls update_option() to store the data in the ai1wm_auth_header option encoded in reversible base64 form.

The write path contains no capability check, nonce verification, is_user_logged_in() check, or confirmation that HTTP Basic authentication actually succeeded. As a result, an unauthenticated request carrying an Authorization: Basic header can cause the plugin to record the provided credentials into the database, or overwrite existing stored credentials, without verifying the requester.

Impact is limited to harvesting or overwriting credentials presented to /wp-admin/ (including WordPress Application Passwords used by REST API integrations). These credentials are stored in reversible encoded form, so an attacker with database access or ability to read the option could recover the original credential material.

How This Could Impact Your Website

In a typical site scenario, a site owner maintains administrator accounts, internal staff operate editors or authors, and third-party integrations or external contractors use WordPress Application Passwords to access the REST API. If an integration or legitimate client presents HTTP Basic authentication or an application password to /wp-admin/, the plugin may store that credential in the ai1wm_auth_header option without verifying authentication. An attacker could:

• Cause the plugin to capture and persist application passwords or basic auth credentials presented by integrations, increasing the exposure of those secrets.
• Overwrite stored credential values by sending crafted anonymous requests with an Authorization: Basic header, potentially disrupting integrations that rely on the stored value.
• Increase the risk of targeted phishing or social-engineering campaigns if internal account identifiers or integration credentials become accessible.

professional review If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.

Recommended Actions

• Update the affected plugin as soon as a patched version is available.
• Review and reduce unnecessary user roles and privileges, especially contributor and editor roles.
• Enforce strong passwords and two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins.
• Monitor site activity and logs for unusual behavior related to authentication and option changes.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.110/lib/controller/class-ai1wm-main-controller.php#L1303
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.110/lib/controller/class-ai1wm-main-controller.php#L1315
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.110/lib/controller/class-ai1wm-main-controller.php#L82
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3696427%40all-in-one-wp-migration&new=3696427%40all-in-one-wp-migration
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5a8737b1-fb68-4609-8474-9395f30c1089?source=cve