Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-17533

All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown All-in-One WP Migration and Backup

Default version status: unaffected

  • 0 to < 7.108affected

References