CVE-2026-81810

All-in-One WP Migration and Backup before version 7.111 performs no capability check on several of its AJAX actions, protecting them only with an installation-wide secret that the plugin discloses to any user permitted to export the site. A user holding that export permission — for example, a role an administrator delegated export to — can therefore call the AJAX import actions and load an arbitrary site archive, since import capability is gated only on knowledge of the secret. Importing a crafted archive grants the attacker full administrator access to the WordPress site. Only sites running a version before 7.111 where an administrator has granted the export capability to a role that lacks the plugin's import capability are affected, which is not a default configuration. No public proof-of-concept, in-the-wild exploitation, or KEV listing is currently known.

What to do: Update the All-in-One WP Migration and Backup plugin to version 7.111 or later. Audit role capabilities and revoke the plugin's export permission from any role that does not also hold import capability, and review recently created or modified administrator accounts for signs of unauthorized imports.