CVE-2026-17533
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The All-in-One WP Migration and Backup WordPress plugin before version 7.108 does not restrict migration import to network administrators on multisite, allowing a subsite admin to execute arbitrary PHP code across the entire network.
Risk Assessment
The risk is critical as it allows a subsite admin to take over the entire multisite network, leading to full compromise.
Recommendation
Update the plugin to version 7.108 or later immediately and implement additional access controls for the import functionality.
Original NVD description (English source)
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.