{"id":"CVE-2026-81810","aliases":["EUVD-2026-82659","GHSA-9wwx-p46x-5vc7"],"status":"published","title":"All-in-One WP Migration and Backup \u003c 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00462,"percentile":0.40508,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-09-18T06:00:12Z","modified":"2026-09-18T19:08:32Z","products":[{"vendor":"servmask","product":"all-in-one wp migration and backup"},{"vendor":"unknown","product":"all-in-one wp migration and backup"}],"references":[{"url":"https://wpscan.com/vulnerability/2036592e-09eb-4231-b450-85d8fbc0ba3f/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81810"},{"url":"https://wpscan.com/vulnerability/2036592e-09eb-4231-b450-85d8fbc0ba3f"},{"url":"https://github.com/advisories/GHSA-9wwx-p46x-5vc7"}],"sources":{"cve":[{"id":"CVE-2026-81810","title":"All-in-One WP Migration and Backup \u003c 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.","status":"published","published":"2026-09-18T06:00:12.086Z","modified":"2026-09-18T11:13:23.973Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-82659","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.","status":"published","published":"2026-09-18T06:00:12Z","modified":"2026-09-18T11:13:23Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:09.240281Z"}],"ghsa":[{"id":"GHSA-9wwx-p46x-5vc7","title":"The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any...","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.","status":"published","published":"2026-09-18T06:31:29Z","modified":"2026-09-18T12:32:19Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:12:10.152672Z"}],"nvd":[{"id":"CVE-2026-81810","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.","status":"published","published":"2026-09-18T06:16:39.193Z","modified":"2026-09-18T19:08:32.83Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:49.70655Z"}]}}