CVE-2026-89064: All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init() method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and admin-post.php requests — reading $SERVER['PHPAUTHUSER'] and $SERVER['PHPAUTHPW'] from any incoming request and writing them to the ai1wmauthheader option via updateoption() as a reversible base64-encoded string, with no capability check, nonce verification, isuserloggedin() check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture into the database, in reversible base64 form, any WordPress Application Password or HTTP Basic credential presented to /wp-admin/ by a legitimate integration, or to overwrite the stored credential with an attacker-chosen value by sending an anonymous request carrying a crafted Authorization: Basic header. This is particularly impactful in environments using WordPress Application Passwords for REST API or third-party integrations, as those credentials are transmitted as HTTP Basic auth to /wp-admin/ and will be silently harvested via this unauthenticated write path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: All-in-One WP Migration and Backupto a version that resolves this vulnerability.Fixed in 7.110 - Compensating control
Temporarily block/limit unauthenticated access to `/wp-admin/admin-ajax.php` and `/wp-admin/admin-post.php` at the network layer (e.g., firewall/WAF/ACL) to prevent attackers from reaching the vulnerable `admin_init` hook endpoint that processes `Authorization: Basic` headers.
- Operational
Inspect the `ai1wm_auth_header` option in the WordPress database for attacker-controlled/replaced values, and if there is evidence of credential harvesting or overwriting, rotate the affected WordPress Application Password(s)/Basic-auth credentials used by integrations that send HTTP Basic auth to `/wp-admin/`.
Event History
Frequently Asked Questions
Which environments face the greatest risk?
Sites that use WordPress Application Passwords for REST API access or third-party integrations are particularly exposed if those integrations present credentials to /wp-admin/. HTTP Basic credentials sent to that path may also be captured.
Does an attacker need a WordPress account or a successful Basic-authentication login?
No. An unauthenticated attacker can send a request with a crafted Authorization: Basic header, and the affected code does not require a capability check, nonce, logged-in user, or confirmation that Basic authentication succeeded.
How can I check whether credentials may have been captured or altered?
Inspect the WordPress ai1wm_auth_header option. The affected plugin writes supplied Basic-authentication username and password data there as a reversible base64-encoded value; an unexpected value may indicate it was overwritten.