What’s Vulnerable › Vulnerabilities
CVE-2026-17533: All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-16 · updated 2026-08-26
- Weakness: CWE-269
Description
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.
Affected products
- All-in-One WP Migration and Backup: before 7.108 — fixed in 7.108
How to fix
Upgrade to a fixed version: All-in-One WP Migration and Backup 7.108. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-17533 or the next vulnerability affects your stack