The vulnerability lies in a missing authorization check in the All‑in‑One WP Migration Unlimited Extension plugin. The handler for creating backup schedules does not verify user capabilities, allowing any authenticated user with subscriber-level or higher access to create scheduled export jobs and set email notifications. Because the notification includes a randomly generated backup filename, an attacker can subsequently download the full site backup, revealing sensitive site data. This flaw corresponds to CWE‑862, Unauthorized Access – Missing Authorization.

The flaw affects WordPress sites that use the All‑in‑One WP Migration Unlimited Extension plugin from servmask. Versions up to and including 2.83 are impacted. Any site using these versions with WordPress user accounts that have subscriber or higher roles is at risk.

The flaw has a CVSS score of 6.5, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated session; an attacker with subscriber-level privileges can create schedules and trigger backup file downloads. No additional exploitation steps are required beyond normal authentication within the WordPress dashboard.