CVE-2026-89064 is a vulnerability in the All-in-One WP Migration and Backup plugin for WordPress affecting versions up to and including 7.110. The vulnerability arises from the Ai1wm_Main_Controller::init() method, which is hooked to admin_init and triggered on unauthenticated admin-ajax.php and admin-post.php requests. This method reads PHP Basic authentication headers ($_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW']) from any incoming request and stores them in the ai1wm_auth_header option as a reversible base64-encoded string without any capability checks, nonce verification, or confirmation of successful authentication. Consequently, unauthenticated attackers can capture or overwrite stored credentials, impacting environments that use WordPress Application Passwords for REST API or third-party integrations.

The vulnerability allows unauthenticated attackers to capture or overwrite HTTP Basic authentication credentials, including WordPress Application Passwords, stored by the plugin in the WordPress database. This can lead to unauthorized credential disclosure or manipulation, potentially compromising REST API or third-party integrations relying on these credentials. There is no direct impact on confidentiality of other data or availability reported. The CVSS score is 5.3 (medium severity) reflecting limited impact on confidentiality and integrity without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to admin-ajax.php and admin-post.php endpoints to trusted users or IP addresses to prevent unauthenticated requests. Monitor for suspicious requests carrying Authorization headers. Avoid using HTTP Basic authentication credentials in environments where this plugin is active or consider disabling the plugin if possible.