EUVD-2026-45884
GHSA-8vwp-3x94-mq44
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible unauthenticated path traversal with no confidentiality impact; constrained write-only capability yields I:L and A:L; no scope change applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
AnalysisAI
Path traversal in the All-in-One WP Migration and Backup WordPress plugin (versions 7.87 through 7.105) allows unauthenticated network attackers to create or append log files at arbitrary filesystem locations outside the plugin's intended storage directory. A publicly available proof-of-concept exploit exists via WPScan and the SSVC framework classifies exploitation as automatable, though EPSS at 0.16% (6th percentile) indicates limited observed opportunistic activity and no CISA KEV listing confirms active exploitation at time of analysis. The constrained write capability - log file creation and appending only, not arbitrary content injection - limits direct impact, but filesystem write access outside the web root could serve as a precursor step in chained attacks depending on server permissions.
Technical ContextAI
The affected component is the All-in-One WP Migration and Backup plugin for WordPress, identified by CPE cpe:2.3:a:unknown:all-in-one_wp_migration_and_backup:*:*:*:*:*:*:*:* across versions 7.87 through 7.105. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the plugin accepts a user-supplied value and incorporates it into a file path construction routine without adequate sanitization or canonicalization, allowing directory traversal sequences such as '../../../' to escape the intended log storage directory. The vulnerability is exposed through the WordPress HTTP interface with no authentication barrier, making it reachable by any network-connected client. The write operation is constrained to log file creation or content appending, not arbitrary payload injection.
RemediationAI
Update the All-in-One WP Migration and Backup plugin to version 7.106 or later, which is the vendor-released patch addressing the path traversal flaw. The update is available through the WordPress plugin repository and via the WordPress admin dashboard under Plugins > Installed Plugins > Update. The WPScan advisory at https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/ confirms the patched version. If immediate update is not feasible, temporarily deactivating the plugin removes the vulnerable endpoint entirely, at the trade-off of losing all backup and migration functionality until the update is applied. As a secondary hardening measure regardless of patch status, ensure the web server process (e.g., www-data) is restricted to minimal filesystem write permissions, particularly outside the WordPress web root, which reduces the effective traversal target space and limits blast radius of any log file creation.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today