CVE-2026-5753

All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download

View on CVE.org

Published May 6, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not verifying user capabilities before saving schedule data. This makes it possible for authenticated attackers, with subscriber-level access and above, to create scheduled export jobs and send backup notifications to attacker-controlled email addresses. Because such notifications include the random backup filename, full site backups can subsequently be downloaded from the target site, resulting in sensitive information exposure.

Analysis

Technical impact

The vulnerability lies in a missing authorization check in the All‑in‑One WP Migration Unlimited Extension plugin. The handler for creating backup schedules does not verify user capabilities, allowing any authenticated user with subscriber-level or higher access to create scheduled export jobs and set email notifications. Because the notification includes a randomly generated backup filename, an attacker can subsequently download the full site backup, revealing sensitive site data. This flaw corresponds to CWE‑862, Unauthorized Access – Missing Authorization.

Affected Systems

The flaw affects WordPress sites that use the All‑in‑One WP Migration Unlimited Extension plugin from servmask. Versions up to and including 2.83 are impacted. Any site using these versions with WordPress user accounts that have subscriber or higher roles is at risk.

Risk and Exploitability

The flaw has a CVSS score of 6.5, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated session; an attacker with subscriber-level privileges can create schedules and trigger backup file downloads. No additional exploitation steps are required beyond normal authentication within the WordPress dashboard.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

servmask

All-in-One WP Migration Unlimited Extension

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.83

No data.

Vendor Product Versions

Servmask

All-in-one Wp Migration Unlimited Extension

Version	Status	Scheme	Platform
`[0,2.83]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the All‑in‑One WP Migration Unlimited Extension plugin to version 2.84 or later.
If an upgrade is not currently possible, temporarily disable the backup schedule creation feature or remove the vulnerable endpoint from the plugin’s admin interface.
Ensure that backup files are stored behind authenticated access and only administrators have download permissions.

Generated by OpenCVE AI on May 6, 2026 at 05:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.266% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://help.servmask.com/knowledgebase/unlimited-extension-changelog/
https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a31080-c124-49be-b9d1-7bc5abe7cbda?source=cve

History

May 6, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 6, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Servmask Servmask all-in-one Wp Migration Unlimited Extension Wordpress Wordpress wordpress
Vendors & Products		Servmask Servmask all-in-one Wp Migration Unlimited Extension Wordpress Wordpress wordpress

May 6, 2026 4:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not verifying user capabilities before saving schedule data. This makes it possible for authenticated attackers, with subscriber-level access and above, to create scheduled export jobs and send backup notifications to attacker-controlled email addresses. Because such notifications include the random backup filename, full site backups can subsequently be downloaded from the target site, resulting in sensitive information exposure.
Title		All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download
Weaknesses		CWE-862
References		https://help.servmask.com/knowledgebase/unlimited-extension-changelog/ https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a31080-c124-49be-b9d1-7bc5abe7cbda?source=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`