Security Alert Summary
The All-in-One WP Migration and Backup WordPress plugin before 7.111 contains missing capability checks on several AJAX actions. The plugin gates those actions using an installation-wide secret that is disclosed to any user permitted to export the site. This can allow such a user to import an arbitrary site archive and gain administrator access when certain non-default role permissions are present.
CVE Details
- CVE ID: CVE-2026-81810
- Affected component: All-in-One WP Migration and Backup WordPress plugin
- Affected versions: Versions before 7.111
- Published: September 18, 2026 at 06:16:39 AM
- Last modified: September 18, 2026 at 12:17:25 PM
- CVSS v3.1: Base score 7.2, severity HIGH, vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Privileges Required: High; User Interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness: CWE-269 (Improper Privilege Management)
Technical Details
The plugin does not perform capability checks on several of its AJAX actions and instead relies on an installation-wide secret. That secret is disclosed to any user who is permitted to export the site. Because the export permission can be granted to roles that do not also have the plugin’s import capability, an exported user who receives the secret can trigger import functionality and import an arbitrary site archive.
When an arbitrary archive is imported, the attacker-controlled archive can include data that results in administrator access. The root cause is the missing capability checks on AJAX actions combined with disclosure of the installation-wide secret to users with the export permission. The CVSS vector indicates network attack feasibility with low attack complexity but requires high privileges and no user interaction for successful exploitation.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who perform content updates, and an external contractor given limited export access to move content. If the export capability is granted to a role that lacks the plugin’s import capability, a user in that role could obtain the installation-wide secret and import an archive that grants administrator-level privileges. This could expose internal user information and allow changes that affect site integrity and availability.
Realistic consequences include exposure of internal user email addresses and increased risk of targeted phishing or social engineering against staff and contractors. If you reassign or grant export permissions, review those roles carefully and avoid granting export to accounts that do not need it.
professional review may help determine whether your site is affected and how to assess current user roles and plugins. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially any accounts granted the export capability.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected imports or role changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
