WordPress Migration Plugin Privilege Escalation on Multisite Networks

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The All-in-One WP Migration and Backup plugin before version 7.108 contains a critical privilege escalation vulnerability that allows subsite administrators to bypass multisite permission controls and execute arbitrary PHP code across an entire WordPress network. This vulnerability stems from improper access controls (CWE-269) on the migration import functionality, which should be restricted to network administrators only. Organizations running WordPress multisite installations with this plugin are at risk, particularly those with multiple independent subsites or tenants, as a compromised or malicious subsite administrator can leverage this flaw to gain network-wide code execution and potentially compromise all sites within the network.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to identify the attack patterns associated with TA0004 (Privilege Escalation) techniques embedded in this vulnerability. Practitioners using Casky would detect anomalies such as: unexpected migration operations initiated from non-network-admin accounts, PHP code injection attempts within backup/migration workflows, unauthorized access to network-level settings from subsite administrator contexts, and suspicious file write operations outside expected plugin directories. The platform's MITRE ATT&CK alignment would flag this as a privilege escalation technique, helping security teams correlate unusual migration activity with potential lateral movement across the multisite network and establish detection rules for import requests originating from insufficient permission levels.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-17533.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-17533

Casky has 224 skills that investigate the attack patterns behind CVE-2026-17533. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn