CVE-2026-6128: All-in-One WP Migration XSS Vulnerability

CVE-2026-6128 Overview

CVE-2026-6128 is a Stored Cross-Site Scripting (XSS) vulnerability in the All-in-One WP Migration Unlimited Extension plugin for WordPress. The flaw affects all versions up to and including 2.84 and stems from insufficient input sanitization on the ai1wm_backups_path parameter combined with missing authorization checks on the settings() function [CWE-79]. Authenticated attackers with Subscriber-level access or higher can inject arbitrary JavaScript that executes when an administrator visits the plugin settings page. The vendor released a partial patch in version 2.84.

Critical Impact
A low-privileged Subscriber account can plant JavaScript that runs in an administrator's browser session, enabling session theft, account takeover, or arbitrary administrative actions on the WordPress site.

Affected Products

ServMask All-in-One WP Migration Unlimited Extension for WordPress
All plugin versions up to and including 2.84
WordPress sites with Subscriber-level (or higher) registration enabled

Discovery Timeline

2026-08-28 - CVE-2026-6128 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-6128

Vulnerability Analysis

The vulnerability is a Stored XSS flaw in the plugin's settings handler. The settings() function processes the ai1wm_backups_path parameter without enforcing capability checks and without sanitizing or escaping the value on output. Any authenticated user, including a Subscriber, can submit a crafted payload that is persisted in plugin settings. When a WordPress administrator later loads the plugin settings page, the injected script executes in the administrator's browser under the site's origin.

Root Cause

Two defects combine to produce the vulnerability. First, the settings() function is missing an authorization check, allowing low-privileged roles to modify configuration values that should be restricted to administrators. Second, the plugin fails to apply input sanitization on the ai1wm_backups_path attribute and fails to apply output escaping when rendering the stored value in the admin UI. The partial fix in version 2.84 did not fully close the injection path.

Attack Vector

Exploitation requires a valid authenticated session at Subscriber level or above, which is common on WordPress sites permitting user registration. The attacker submits an HTTP request to the plugin settings endpoint containing a JavaScript payload in the ai1wm_backups_path field. The payload is stored server-side. Execution occurs when any administrator visits the plugin settings page, at which point the script runs with the administrator's privileges and can create new admin users, plant backdoors, or exfiltrate authenticated session data.

No verified proof-of-concept code is published in the referenced advisories. See the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-6128

Indicators of Compromise

Unexpected values in the ai1wm_backups_path plugin option containing HTML tags, <script> fragments, event handlers such as onerror=, or javascript: URIs
New WordPress administrator accounts created shortly after a Subscriber-level user modified plugin settings
POST requests to the All-in-One WP Migration settings endpoint originating from Subscriber-role accounts
Outbound requests from administrator browsers to unfamiliar domains immediately after loading the plugin settings page

Detection Strategies

Audit the WordPress wp_options table for entries associated with All-in-One WP Migration and inspect the stored ai1wm_backups_path value for script content
Enable and review WordPress audit logs for settings changes performed by non-administrator roles
Deploy a Content Security Policy (CSP) in report-only mode to surface inline-script violations rendering on the plugin admin page

Monitoring Recommendations

Alert on plugin option updates performed by users below the Administrator role
Monitor /wp-admin/admin.php and /wp-admin/admin-ajax.php requests targeting All-in-One WP Migration handlers
Track creation of new administrator accounts and REST API key generation events
Review web server logs for anomalous POST bodies containing HTML or JavaScript tokens directed at the plugin

How to Mitigate CVE-2026-6128

Immediate Actions Required

Update All-in-One WP Migration Unlimited Extension beyond version 2.84 once a complete fix is released, per the ServMask Extension Changelog
Audit existing Subscriber and low-privilege accounts and remove any that are unnecessary or unrecognized
Inspect and, if required, reset the ai1wm_backups_path setting to a known-good filesystem path
Rotate administrator passwords and invalidate active sessions if compromise is suspected

Patch Information

ServMask released a partial patch in version 2.84. Because the fix is incomplete, monitor the vendor changelog for a subsequent release that fully addresses both the missing authorization check on settings() and the sanitization gap on ai1wm_backups_path. Review the Wordfence Vulnerability Report for current patch status.

Workarounds

Disable open user registration or restrict the default new-user role to a capability level that cannot access plugin endpoints
Deactivate the All-in-One WP Migration Unlimited Extension plugin until a complete patch is available
Deploy a web application firewall rule to block requests containing HTML or script tokens in the ai1wm_backups_path parameter
Enforce a strict Content Security Policy on /wp-admin/ to block inline script execution

bash

# Example WordPress role hardening to restrict Subscriber capabilities
wp user list --role=subscriber --format=table
wp option get users_can_register
wp option update users_can_register 0
wp plugin deactivate all-in-one-wp-migration-unlimited-extension