All-in-One WP Migration CVE-2026-12898

No authentication is required and no special plugin configuration is needed beyond having the All-in-One WP Migration and Backup plugin installed and active on a WordPress site running version 7.87 through 7.105. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation with no complexity barriers - no specific WordPress role, no administrator session, and no non-default plugin setting is required. The SSVC classification of Automatable:Yes indicates this attack can be executed at scale without manual interaction per target. The primary limiting factor is the constrained impact scope: attackers can only create or append log file content to traversed paths, not execute code or read existing files. A secondary constraint is filesystem permissions - if the WordPress environment runs with hardened OS-level write restrictions, the set of reachable traversal destinations is narrowed. Sites where the web server process is confined to the web root or where AppArmor/SELinux profiles are active face meaningfully reduced exposure beyond the intended storage directory.

The CVSS 3.1 score of 6.5 (Medium) reflects network-accessible unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) with limited, partial integrity and availability impact (I:L/A:L, C:N). These metrics are consistent with the description - no confidentiality breach, no code execution, constrained write. The EPSS score of 0.16% at the 6th percentile is low, suggesting limited observed exploitation in the wild at time of analysis, which is consistent with the absence of a CISA KEV listing. However, the SSVC classification of Automatable:Yes is a meaningful counterweight - the attack is scriptable, requires no user interaction, and can be directed at scale against all exposed WordPress installations running the affected plugin version. The public POC via WPScan further reduces attacker friction. Real-world risk is therefore moderate: not a drop-everything emergency given the constrained write-only impact, but the automatable nature, wide plugin deployment footprint, and POC availability justify prompt patching rather than deferral. Secondary risk exists if the web server process has write access to the web root, enabling file placement as a stepping stone to further compromise.

A publicly available proof-of-concept exists via WPScan. An unauthenticated attacker sends a crafted HTTP request to the target WordPress installation embedding path traversal sequences in the user-supplied value processed by the plugin's file path construction routine, causing the plugin to create or append a log file in an attacker-specified directory outside the intended storage path. If the web server process has write access to the WordPress web root or other sensitive directories, this file placement capability could be used as a precursor step - for example, to write content to a known location for retrieval or to stage a follow-on attack.