PT-2026-37342 · WordPress · All-In-One Wp Migration Unlimited Extension

Sélim Lanouar · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-5753

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration Unlimited Extension versions prior to 2.84

Description The plugin is affected by missing authorization. The Ai1wmve Schedules Controller::save function for the 'admin post ai1wm schedule event save' endpoint does not verify user capabilities before saving schedule data. This allows authenticated attackers with subscriber-level access or higher to create scheduled export jobs and direct backup notifications to email addresses they control. Since these notifications contain the random backup filename, attackers can download full site backups, leading to the exposure of sensitive information.

Recommendations Update to a version later than 2.83.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-5753

Affected Products

All-In-One Wp Migration Unlimited Extension

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-5753 · Security Note
• https://twitter.com/infoflowcloud/status/2051930086354321609 · Twitter Post
• https://t.me/CVEtracker/52815 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051928506066489515 · Twitter Post
• https://t.me/cveNotify/162320 · Telegram Post
• https://twitter.com/CVEnew/status/2051928702599188741 · Twitter Post
• https://help.servmask.com/knowledgebase/unlimited-extension-changelog · Note
• https://t.me/cveNotify/162285 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a8a31080-c124-49be-b9d1-7bc5abe7cbda?source=cve · Note