Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89064— All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

Quick assessment

Affected
servmask All-in-One WP Migration and Backup
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的“All-in-One WP Migration and Backup”插件在 7.110 及更早版本中存在凭据保护不足漏洞。 该漏洞源于 方法。该方法通过 钩子注册，而该钩子在未认证的 和 请求中会被触发。该方法会直接读取任意传入请求中的 和 ，并通过 将其以可逆的 Base64 编码字符串形式写入 选项。整个过程未进行任何权限检查（capability check）、nonce 验证、 检查，也未确认 Basic 认证是否真正成功。 这导致未认证的 attackers（攻击者）可以： 1.

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1079
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89064

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
Source: CVE Program / CVE List V5
Vulnerability Description
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method — registered on the `admin_init` hook, which fires unauthenticated on `admin-ajax.php` and `admin-post.php` requests — reading `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writing them to the `ai1wm_auth_header` option via `update_option()` as a reversible base64-encoded string, with no capability check, nonce verification, `is_user_logged_in()` check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture into the database, in reversible base64 form, any WordPress Application Password or HTTP Basic credential presented to `/wp-admin/` by a legitimate integration, or to overwrite the stored credential with an attacker-chosen value by sending an anonymous request carrying a crafted `Authorization: Basic` header. This is particularly impactful in environments using WordPress Application Passwords for REST API or third-party integrations, as those credentials are transmitted as HTTP Basic auth to `/wp-admin/` and will be silently harvested via this unauthenticated write path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
servmask All-in-One WP Migration and Backup 0 ~ 7.110 -

II. Public POCs for CVE-2026-89064

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89064

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-89064 (1)

Vendor Pages for CVE-2026-89064 (1)

Other References for CVE-2026-89064 (1)

IV. Related Vulnerabilities

Same product: All-in-One WP Migration and Backup
Same vendor: servmask
Same weakness: CWE-522

V. Comments for CVE-2026-89064

No comments yet

Leave a comment