CVE-2026-5753

Missing

Authorization in Schedule Controller

The All-in-One WP Migration Unlimited Extension plugin for WordPress, up to version 2.83, contains a missing authorization vulnerability in the Ai1wmve_Schedules_Controller::save handler. The handler for the admin_post_ai1wm_schedule_event_save action does not verify user capabilities before saving schedule data, allowing any authenticated user with subscriber-level access or higher to create scheduled export jobs [1].

Exploitation and

Attack Surface

An attacker who is authenticated as a subscriber (or higher) can craft a request to the vulnerable endpoint to create a scheduled backup event. The plugin then sends backup notifications to email addresses specified by the attacker. These notifications include the random backup filename, which is otherwise not publicly accessible [1].

Impact

With the backup filename in hand, the attacker can directly download the full site backup from the target WordPress installation. This exposes all site data, including database contents, uploaded files, and configuration details, leading to sensitive information exposure [1].

Mitigation

The vendor addressed this issue in version 2.84 of the Unlimited Extension, released on April 16, 2026, which fixed the permission issue in the settings form [1]. Users are strongly advised to update to version 2.84 or later.