CVE-2026-81810: WordPress All-in-One Migration Auth Bypass

CVE-2026-81810 Overview

CVE-2026-81810 is a privilege escalation vulnerability in the All-in-One WP Migration and Backup WordPress plugin before version 7.111. The plugin fails to enforce capability checks on several AJAX actions, gating access only through an installation-wide secret. That secret is disclosed to any user granted the export capability, enabling them to invoke import functionality reserved for administrators. An attacker with export rights can upload an arbitrary site archive and gain administrator access to the WordPress installation. Exploitation depends on a non-default configuration where an administrator has delegated the export capability to a role lacking the import capability. The weakness is categorized as [CWE-269] Improper Privilege Management.

Critical Impact
A low-privileged user granted export capability can import a malicious site archive and take over the WordPress site as administrator.

Affected Products

All-in-One WP Migration and Backup WordPress plugin versions prior to 7.111
WordPress installations that have delegated the plugin's export capability to non-administrator roles
Any WordPress site running the vulnerable plugin with a non-default role configuration

Discovery Timeline

2026-09-18 - CVE-2026-81810 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-81810

Vulnerability Analysis

The All-in-One WP Migration and Backup plugin exposes several AJAX endpoints that perform sensitive actions, including importing full site archives. These endpoints do not verify that the calling user holds the plugin's dedicated import capability. Instead, they rely solely on an installation-wide secret token to authorize requests.

The plugin discloses this secret to any authenticated user who is permitted to export the site. An attacker who holds only the export capability can read the shared secret and reuse it to call import-only endpoints. Importing a crafted archive replaces site content, including the users table, and yields administrator access.

The issue stems from conflating authentication with authorization. Possession of a shared secret is treated as proof of privilege, even when the requesting user's WordPress role does not include the required capability.

Root Cause

The root cause is missing capability enforcement in AJAX action handlers. WordPress plugins are expected to call current_user_can() against the specific capability required for each action. The plugin instead gates multiple import-related actions behind a single secret that is available to a broader set of users than the action requires.

Attack Vector

Exploitation is network-based and requires an authenticated session with the plugin's export capability. The attacker retrieves the disclosed secret through the export workflow, then issues a crafted AJAX request to an import endpoint while supplying the secret. The request uploads and restores an attacker-controlled .wpress archive containing an administrator account. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-81810

Indicators of Compromise

Unexpected calls to plugin AJAX actions such as wp-admin/admin-ajax.php?action=ai1wm_import originating from non-administrator sessions
Creation of new administrator accounts shortly after archive import operations
Unexplained .wpress uploads in wp-content/ai1wm-backups/ or plugin storage directories
WordPress users and usermeta tables replaced or modified outside of a scheduled migration window

Detection Strategies

Correlate WordPress audit logs of AJAX requests to plugin endpoints with the initiating user's role and capabilities
Alert when a user without the plugin's import capability triggers import-related AJAX actions
Monitor plugin backup directories for archive files created by non-administrator users

Monitoring Recommendations

Ingest WordPress and web server access logs into a centralized log platform for query and retention
Track administrator account creations and role changes in near real time
Baseline normal use of migration functionality and alert on deviations, especially imports from unexpected accounts

How to Mitigate CVE-2026-81810

Immediate Actions Required

Update the All-in-One WP Migration and Backup plugin to version 7.111 or later on all WordPress sites
Audit WordPress roles and remove the plugin's export capability from any non-administrator role until patched
Review recently created administrator accounts and revoke any that cannot be attributed to a legitimate change

Patch Information

The vendor addressed the vulnerability in All-in-One WP Migration and Backup version 7.111. Upgrading to this release adds the missing capability checks to the affected AJAX handlers. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict the plugin's export capability to administrator roles only until the patch is applied
Disable or remove the plugin on sites that do not actively require migration functionality
Restrict access to wp-admin/admin-ajax.php from untrusted networks using a web application firewall rule

bash

# Example WP-CLI commands to inventory and remediate role capabilities
wp plugin update ai1wm --version=7.111
wp role list --fields=role,name
wp cap list editor | grep -i ai1wm
wp cap remove editor ai1wm_export