Missing Authorization Vulnerability in All-in-One WP Migration Unlimited Extension Plugin

CVE-2026-5753

What is CVE-2026-5753?

The All-in-One WP Migration Unlimited Extension for WordPress exhibits a Missing Authorization issue due to the failure of the 'Ai1wmve_Schedules_Controller::save' handler to verify user capabilities when saving scheduled export jobs. This vulnerability allows authenticated users with subscriber-level access and above to create export jobs that may send backup notifications to malicious email addresses. These notifications leak sensitive information, including backup filenames, potentially enabling attackers to download full site backups and expose confidential data stored on the site.

References