CVE-2026-17533 All-in-One WP Migration and Backup CVE debrief

Who should care

Administrators of WordPress multisite installations using the All-in-One WP Migration and Backup plugin, as well as security teams responsible for monitoring and patching vulnerabilities in WordPress plugins, should prioritize updating the plugin and restricting migration import functionality to network administrators. Additionally, security teams should review incident response plans and implement compensating controls to detect and prevent code execution.

Technical summary

The All-in-One WP Migration and Backup WordPress plugin before 7.108 is vulnerable to arbitrary PHP code execution due to insufficient restrictions on migration import functionality. This allows an administrator of a single subsite on multisite installations to execute code across the entire network. The vulnerability is a result of the plugin's lack of proper access controls, enabling an attacker with administrative privileges on a single subsite to execute PHP code across the entire network. To mitigate this vulnerability, defenders should verify the plugin version, review migration import functionality restrictions, and monitor for suspicious activity on affected systems.

Defensive priority

High priority due to high CVSS score and potential for code execution.

Recommended defensive actions

• Verify the plugin version and update to 7.108 or later.
• Restrict migration import functionality to network administrators on multisite installations.
• Monitor for suspicious activity on affected systems.
• Implement compensating controls to detect and prevent code execution.
• Review and update incident response plans.

Evidence notes

Evidence from WPScan indicates a vulnerability in the All-in-One WP Migration and Backup WordPress plugin. Official CVE and NVD records provide additional context. The vulnerability allows an administrator of a single subsite on multisite installations to execute arbitrary PHP code across the entire network. Defenders should verify the plugin version, review migration import functionality restrictions, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.