{"id":"CVE-2026-17533","aliases":["EUVD-2026-59911","GHSA-qgjj-8h65-3vcm"],"status":"published","title":"All-in-One WP Migration and Backup \u003c 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00462,"percentile":0.40336,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-08-16T06:00:15Z","modified":"2026-08-26T16:30:52Z","products":[{"vendor":"servmask","product":"all-in-one wp migration and backup"},{"vendor":"unknown","product":"all-in-one wp migration and backup"}],"references":[{"url":"https://wpscan.com/vulnerability/13b57cdc-d954-4db6-94c2-53ad04ab0d34/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17533"},{"url":"https://wpscan.com/vulnerability/13b57cdc-d954-4db6-94c2-53ad04ab0d34"},{"url":"https://github.com/advisories/GHSA-qgjj-8h65-3vcm"}],"sources":{"cve":[{"id":"CVE-2026-17533","title":"All-in-One WP Migration and Backup \u003c 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.","status":"published","published":"2026-08-16T06:00:15.315Z","modified":"2026-08-17T20:19:59.343Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:19:54.84674Z"}],"euvd":[{"id":"EUVD-2026-59911","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.","status":"published","published":"2026-08-16T06:00:15Z","modified":"2026-08-17T20:19:59Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:48.026284Z"}],"ghsa":[{"id":"GHSA-qgjj-8h65-3vcm","title":"The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its...","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.","status":"published","published":"2026-08-16T06:30:25Z","modified":"2026-08-17T21:31:19Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:10:35.189726Z"}],"nvd":[{"id":"CVE-2026-17533","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.","status":"published","published":"2026-08-16T06:16:51.34Z","modified":"2026-08-26T16:30:52.723Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:38.647684Z"}]}}