CVE-2026-89064: WordPress All-in-One WP Migration Plugin Flaw

CVE-2026-89064 Overview

CVE-2026-89064 affects the All-in-One WP Migration and Backup plugin for WordPress in versions up to and including 7.110. The plugin's Ai1wm_Main_Controller::init() method writes HTTP Basic authentication credentials extracted from any incoming request into the ai1wm_auth_header WordPress option using reversible base64 encoding. No capability check, nonce verification, or authentication validation gates this write path. Unauthenticated attackers can harvest WordPress Application Passwords transmitted to /wp-admin/ by legitimate REST API integrations, or overwrite the stored credential with an attacker-controlled value. The weakness is classified under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Unauthenticated attackers can capture or overwrite WordPress Application Passwords and HTTP Basic credentials used by third-party integrations, enabling downstream account takeover of privileged API consumers.

Affected Products

All-in-One WP Migration and Backup plugin for WordPress
All plugin versions up to and including 7.110
WordPress installations exposing admin-ajax.php or admin-post.php to the internet

Discovery Timeline

2026-09-17 - CVE CVE-2026-89064 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-89064

Vulnerability Analysis

The vulnerability lives in Ai1wm_Main_Controller::init(), which the plugin registers on the admin_init action hook. Contrary to its name, admin_init fires on every request to admin-ajax.php and admin-post.php, including fully unauthenticated ones. The plugin reads $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] directly from the request and passes them to update_option() after base64 encoding, storing them in the ai1wm_auth_header option.

The handler performs no current_user_can() capability check, no wp_verify_nonce() validation, no is_user_logged_in() gate, and no verification that Basic authentication actually succeeded against WordPress. Any anonymous request carrying an Authorization: Basic header will trigger the write.

Root Cause

The root cause is a missing authorization check on a state-changing hook combined with reversible encoding of credentials. Base64 is not a cryptographic protection, so any actor with read access to the WordPress options table can trivially decode captured credentials back to plaintext.

Attack Vector

Two abuse patterns are possible over the network. First, an attacker races or waits for a legitimate integration to authenticate against /wp-admin/ using a WordPress Application Password, then reads the stored ai1wm_auth_header option to recover the plaintext credential. Second, an attacker sends an anonymous request to admin-ajax.php or admin-post.php with a crafted Authorization: Basic header, overwriting the stored value with attacker-controlled credentials to poison downstream authentication flows.

See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the vulnerable source lines.

Detection Methods for CVE-2026-89064

Indicators of Compromise

Presence of a populated ai1wm_auth_header row in the WordPress wp_options table on sites that do not intentionally use HTTP Basic authentication in front of /wp-admin/.
Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php or /wp-admin/admin-post.php containing an Authorization: Basic header from unexpected source IPs.
Sudden changes to the ai1wm_auth_header option value without a corresponding administrator session in access logs.

Detection Strategies

Audit the wp_options table for the ai1wm_auth_header key and base64-decode its value to confirm whether captured credentials match known legitimate integrations.
Parse web server logs for anonymous requests that both hit admin-ajax.php or admin-post.php and carry an Authorization header.
Correlate WordPress Application Password issuance events with subsequent modifications to ai1wm_auth_header to identify possible credential harvesting.

Monitoring Recommendations

Enable file integrity and database change monitoring on WordPress options rows related to installed plugins.
Forward WordPress and web server logs to a centralized analytics platform and alert on Authorization: Basic headers reaching unauthenticated endpoints.
Track outbound API activity from WordPress-integrated services for anomalous authentication failures indicating credential rotation or takeover.

How to Mitigate CVE-2026-89064

Immediate Actions Required

Update the All-in-One WP Migration and Backup plugin to a version newer than 7.110 as soon as a patched release is available from the vendor.
Rotate all WordPress Application Passwords and any HTTP Basic credentials used against /wp-admin/ on affected sites.
Delete the ai1wm_auth_header option from wp_options after patching to purge any harvested credential material.

Patch Information

Review the vendor's remediation in the WordPress Plugin Changeset and monitor the Wordfence Vulnerability Report for the fixed version. Until a patched release is installed, treat every affected WordPress site as if its stored integration credentials are compromised.

Workarounds

Deactivate the All-in-One WP Migration and Backup plugin until a patched version is deployed.
Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php at the web server or WAF layer, blocking unauthenticated requests that include an Authorization: Basic header.
Move server-to-server integrations off WordPress Application Passwords to short-lived OAuth tokens where feasible to reduce blast radius if credentials are captured.

bash

# Example NGINX rule blocking unauthenticated Basic auth to admin endpoints
location ~ ^/wp-admin/(admin-ajax|admin-post)\.php$ {
    if ($http_authorization ~* "^Basic") {
        return 403;
    }
}