CVE-2026-89064 servmask CVE debrief

Who should care

WordPress administrators and security teams should assess the risk of credential capture and overwriting in their environments, especially those using Application Passwords for integrations.

Why it matters

CVE-2026-89064 allows unauthenticated attackers to capture and store credentials, posing a significant risk to WordPress environments using Application Passwords or HTTP Basic authentication. Defenders should verify exposure, assess risk, and prioritize patching and credential management.

• Capture of WordPress Application Passwords or HTTP Basic credentials in reversible base64 form.
• Overwriting of stored credentials with attacker-chosen values.
• Potential unauthorized access to sensitive data or functionality.
• Verification of patch deployment and credential management practices.

Technical summary

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. The `Ai1wm_Main_Controller::init()` method reads `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writes them to the `ai1wm_auth_header` option as a reversible base64-encoded string, without proper authentication or authorization checks.

Defensive priority

Defenders should prioritize verifying exposure and assessing the risk of credential capture and overwriting in their WordPress environments, especially those using Application Passwords for integrations.

Recommended defensive actions

• Verify if the All-in-One WP Migration and Backup plugin version is 7.110 or earlier and update to a patched version if necessary.
• Assess the risk of credential capture and overwriting in WordPress environments, especially those using Application Passwords for integrations.
• Monitor for suspicious activity related to the `admin-ajax.php` and `admin-post.php` requests.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the plugin's insecure handling of authentication credentials in the `Ai1wm_Main_Controller::init()` method, which can be exploited via unauthenticated requests to `admin-ajax.php` and `admin-post.php`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.