Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2026-81810: All-in-One WP Migration allows admin takeover via import key
CVE-2026-81810 · published 1 month ago
Summary
The All-in-One WP Migration and Backup plugin for WordPress can let a user who is only allowed to export data import any site archive and become an administrator. This happens because the plugin shares a secret code that should be hidden, and it does not check the user's permissions before processing the import. Make sure the plugin is updated to the latest version and review who has export rights in your WordPress site.
What to do
- Update unknown all-in-one wp migration and backup to version 7.111 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | all-in-one wp migration and backup | < 7.111 |
Original advisory text
All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.2
High
Type
CWE-269Improper Privilege Management
Timeline
Published18 Sep 2026
Updated4 Nov 2026
First seen18 Sep 2026
Track software like this
Free during beta