CVE-2026-5753 servmask CVE debrief

Who should care

Administrators of WordPress sites using the All-in-One WP Migration Unlimited Extension plugin, especially those with subscriber-level access or above, should be aware of this vulnerability and take immediate action to protect their sites. They should review their site's exposure, apply updates or mitigations, and monitor for suspicious activity.

Technical summary

The vulnerability exists in the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' in the All-in-One WP Migration Unlimited Extension plugin. The handler fails to verify user capabilities before saving schedule data, allowing authenticated attackers with subscriber-level access and above to create scheduled export jobs and send backup notifications to attacker-controlled email addresses. This can lead to sensitive information exposure if backup notifications include random backup filenames.

Defensive priority

High

Recommended defensive actions

• Update the All-in-One WP Migration Unlimited Extension plugin to a version that fixes the vulnerability.
• Restrict access to the plugin's settings and features to authorized personnel only.
• Monitor site activity for suspicious scheduled export jobs and backup notifications.
• Implement additional security measures, such as two-factor authentication and regular backups.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-05-06T04:16:09.097Z and was last modified on 2026-07-24T09:10:00.153Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD data. Defenders should verify product presence, review official advisories, and monitor for suspicious activity.

Official resources