Executive brief
The All-in-One WP Migration and Backup plugin allows unauthenticated attackers to capture or overwrite WordPress credentials stored in the database. The vulnerability intercepts HTTP Basic authentication headers (used by integrations and REST API clients) and silently records them without any security checks, exposing sensitive passwords and API keys to anyone who can access the WordPress database or control network traffic.
Technical details
The vulnerability is insufficient credential protection in the `Ai1wm_Main_Controller::init()` method. The method is registered on the `admin_init` hook, which fires unauthenticated on requests to `admin-ajax.php` and `admin-post.php`. The vulnerable code reads `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from the incoming request and writes them as a reversible base64-encoded string to the `ai1wm_auth_header` option using `update_option()`, with no capability check, nonce verification, authentication check, or confirmation that HTTP Basic authentication actually succeeded. An unauthenticated attacker can send a crafted `Authorization: Basic` header to exploit this, capturing legitimate credentials or injecting attacker-controlled values. The flaw is particularly dangerous in environments relying on WordPress Application Passwords for REST API or third-party integrations, as those credentials are transmitted as HTTP Basic auth to `/wp-admin/` and will be automatically harvested.
Affected products
- ServMask All-in-One WP Migration up to and including 7.110
Timeline
- 2026-09-17: disclosed