Executive brief
All-in-One WP Migration and Backup is a WordPress plugin that allows site administrators and authorized users to export and import site archives for backup and migration purposes. The plugin fails to properly validate user permissions on critical import operations, allowing a user with export privileges to obtain a shared secret and use it to import a malicious site archive, thereby gaining administrative access to the WordPress installation.
Technical details
The plugin uses an installation-wide secret to gate several AJAX actions instead of performing proper WordPress capability checks. Any user granted export permissions can access and disclose this secret, which is then usable to perform import operations—including importing arbitrary site archives—without holding the plugin's own import capability. This is an authenticated privilege escalation vulnerability (CWE-269) that requires an administrator to have configured a non-default role with export but not import permissions. The vulnerability affects versions before 7.111 and is fixed in version 7.111 or later.
Affected products
- Wordpress.org All-in-One WP Migration and Backup before 7.111
Timeline
- 2026-09-16: disclosed
- 2026-09-18: patched: version 7.111 released