CVE-2026-89064 affects the All-in-One WP Migration and Backup plugin for WordPress, in versions up through 7.110. A controller method tied to an unauthenticated admin hook reads any HTTP Basic Auth credentials sent in a request and stores them directly into a site option. Because the endpoint doesn't require a login, an attacker could potentially plant arbitrary credential values in the plugin's stored auth header.
// source: nvd.nist.gov ↗