CVE-2026-17533 is a CWE-269 improper privilege management vulnerability in the All-in-One WP Migration and Backup WordPress plugin versions prior to 7.108. The flaw allows an administrator of a single subsite on a multisite WordPress installation to bypass intended restrictions and execute arbitrary PHP code network-wide by exploiting the migration import functionality. This elevates privileges beyond the subsite scope, potentially compromising the entire multisite network.

Successful exploitation allows a subsite administrator to execute arbitrary PHP code across the entire multisite WordPress network, leading to full compromise of all sites within the network. This impacts confidentiality, integrity, and availability of the affected WordPress installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 7.108, upgrading to version 7.108 or later is likely required once confirmed. Until then, restrict subsite administrator privileges and monitor for suspicious activity.