What the vulnerability does
01Description
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not verifying user capabilities before saving schedule data. This makes it possible for authenticated attackers, with subscriber-level access and above, to create scheduled export jobs and send backup notifications to attacker-controlled email addresses. Because such notifications include the random backup filename, full site backups can subsequently be downloaded from the target site, resulting in sensitive information exposure.
Explanation of Vulnerability in Simple Terms
02Summary
The All-in-One WP Migration Unlimited Extension through version 2.83 does not properly check user permissions before allowing access to sensitive functions. A logged-in user with low privileges can read data they should not have access to, such as backup files or configuration details. Update to a version newer than 2.83 to fix this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive site data like backups or configuration files without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can access backups, database exports, or other sensitive migration data stored by the plugin.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
May 6, 2026
CVE published
May 6, 2026
Record updated
