CVE-2026-17533: CWE-269 Improper Privilege Management in All-in-One WP Migration and Backup
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.
AI Analysis
Technical Summary
CVE-2026-17533 is an improper privilege management vulnerability (CWE-269) in the All-in-One WP Migration and Backup WordPress plugin. Versions prior to 7.108 fail to restrict the migration import feature to network administrators on multisite setups. This flaw enables an administrator of a single subsite to execute arbitrary PHP code with elevated privileges across the entire multisite network, potentially compromising all sites within that network.
Potential Impact
An attacker with administrator access to a single subsite in a multisite WordPress environment can leverage this vulnerability to execute arbitrary PHP code across the entire network. This could lead to full compromise of all sites in the multisite installation, including data theft, site defacement, or further malware deployment.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should upgrade to version 7.108 or later once available, as the vulnerability affects versions before 7.108. Until a patch is released, restrict subsite administrator privileges and monitor multisite environments carefully. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-17533: CWE-269 Improper Privilege Management in All-in-One WP Migration and Backup
Description
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-17533 is an improper privilege management vulnerability (CWE-269) in the All-in-One WP Migration and Backup WordPress plugin. Versions prior to 7.108 fail to restrict the migration import feature to network administrators on multisite setups. This flaw enables an administrator of a single subsite to execute arbitrary PHP code with elevated privileges across the entire multisite network, potentially compromising all sites within that network.
Potential Impact
An attacker with administrator access to a single subsite in a multisite WordPress environment can leverage this vulnerability to execute arbitrary PHP code across the entire network. This could lead to full compromise of all sites in the multisite installation, including data theft, site defacement, or further malware deployment.
Mitigation Recommendations
No official fix or patch is currently confirmed. Users should upgrade to version 7.108 or later once available, as the vulnerability affects versions before 7.108. Until a patch is released, restrict subsite administrator privileges and monitor multisite environments carefully. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-27T09:11:40.271Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8154acbf8831d53998d6e1
Added to database: 08/16/2026, 06:11:56 UTC
Last enriched: 08/16/2026, 06:29:24 UTC
Last updated: 08/16/2026, 17:57:47 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.