Insufficient Credential Protection in All-in-One WP Migration Plugin for WordPress

CVE-2026-89064

What is CVE-2026-89064?

The All-in-One WP Migration and Backup plugin for WordPress suffers from a significant vulnerability due to its handling of incoming requests without proper authentication checks. Specifically, the Ai1wm_Main_Controller::init() method can be triggered on unauthenticated requests, exposing sensitive user credentials such as WordPress Application Passwords and HTTP Basic credentials. This vulnerability allows attackers to capture these credentials in the database using base64 encoding, or to overwrite existing values through crafted requests. The lack of nonce verification, capability checks, and confirmation of Basic authentication success creates a severe risk, particularly for users relying on these credentials for REST API operations and third-party integrations.

References