Unauthorized Access Vulnerability in All-in-One WP Migration and Backup Plugin by WordPress
CVE-2026-81810
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 September 2026
Badges
What is CVE-2026-81810?
The All-in-One WP Migration and Backup plugin for WordPress exhibits a significant security flaw, wherein it fails to enforce proper capability checks across several AJAX actions. This shortcoming is due to the reliance on an installation-wide secret, which is accessible to any user authorized to export the site. Consequently, a user with the export capability can leverage this vulnerability to import arbitrary site archives, potentially leading to unauthorized administrative access. It is crucial for website admins to ensure the export permission is granted solely to trusted roles, as the default configuration may not align with security best practices.
Affected Version(s)
All-in-One WP Migration and Backup 0 < 7.111
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.