Description

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-16T06:16:51.340Z",
  "pubdate": "2026-08-16T06:16:51.340Z",
  "executiveSummary": "An improper access control vulnerability has been identified in the All-in-One WP Migration and Backup WordPress plugin affecting all versions prior to 7.108. The flaw specifically resides within multisite WordPress installations, where the plugin fails to properly restrict its migration import functionality exclusively to network administrators. This architectural oversight allows an authenticated user holding standard administrator privileges on a single subsite within the network to bypass intended security boundaries. By leveraging the unrestricted import capabilities, a malicious subsite administrator can execute arbitrary PHP code across the entire WordPress multisite network. The risk implications are severe, as a low-privileged administrator within a localized context can escalate privileges to achieve full network-wide Remote Code Execution (RCE). The exploitation requirements necessitate that the attacker already possesses administrator credentials for an individual subsite and that the vulnerable All-in-One WP Migration and Backup plugin is installed and activated on the multisite network. Successful exploitation grants the attacker complete control over the underlying server hosting the multisite environment, threatening the confidentiality, integrity, and availability of all interconnected subsites and network resources.",
  "technicalDetails": "The vulnerability stems from flawed access control enforcement within the migration import functionality of the All-in-One WP Migration and Backup plugin. In a WordPress multisite architecture, sensitive administrative capabilities—particularly those affecting system-wide configurations or file system operations—must be strictly limited to network-level administrators (super administrators). However, prior to version 7.108, the plugin's import subsystem fails to adequately validate whether the initiating user possesses network-wide administrative privileges, incorrectly permitting subsite administrators to access and execute import routines.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress multisite environment with credentials for a single subsite, possessing standard subsite administrator privileges. Second, the attacker navigates to or interacts with the migration import component provided by the vulnerable plugin. Because the migration import functionality processes user-supplied backup archives—which typically contain database dumps and executable PHP files intended to overwrite or restore the site state—the lack of proper privilege checks allows the import routine to process the payload without restriction.\nThird, the attacker crafts or uploads a malicious migration archive containing arbitrary PHP payloads, such as web shells or custom execution scripts. Upon initiating the import process, the plugin extracts and writes these malicious files into the web root or executes the embedded database queries across the environment. Because the import operates globally or lacks isolation for multisite boundaries, the execution of these payloads is not constrained to the attacker's subsite.\nConsequently, the post-exploitation impact includes arbitrary PHP code execution across the entire network, allowing the attacker to compromise the core WordPress installation, access sensitive database contents belonging to other subsites, pivot to the underlying operating system, and achieve complete system compromise. The vulnerable component is the migration import handler within versions of the All-in-One WP Migration and Backup plugin prior to 7.108."
}