All In One Wp Migration And Backup
Monthly
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin before 7.111 allows an authenticated user who has been granted the plugin's export capability - but not its import capability - to obtain an installation-wide secret and replay it against the plugin's import AJAX actions, importing an arbitrary site archive and gaining administrator access. Exploitation is not possible against a default install: it requires a non-default configuration in which an administrator has delegated the plugin's export capability to a role that does not also hold import capability, and the target site must run a version older than 7.111. Publicly available exploit code exists (reported via WPScan), making the flaw attractive to attackers who already hold a low-privileged account on a misconfigured site; the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (high impact, but with a hard configuration prerequisite).
SQL injection in the All-in-One WP Migration and Backup plugin (servmask, versions through 7.109) enables a two-stage attack path culminating in remote code execution. Insufficient parameterization in the archive restore database layer allows attackers to append arbitrary SQL queries and exfiltrate the ai1wm_secret_key from the WordPress database; once obtained, this key unlocks the plugin's restore endpoint and enables RCE. No KEV listing or EPSS data is available at time of analysis, but the direct RCE chaining potential makes this a high-priority remediation target for any WordPress site running the affected plugin.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.
Unauthenticated attackers can write to the WordPress database option ai1wm_auth_header in All-in-One WP Migration and Backup versions up to 7.110 by sending a crafted Authorization: Basic header to admin-ajax.php or admin-post.php, because the plugin's Ai1wm_Main_Controller::init() method on the admin_init hook reads PHP_AUTH_USER and PHP_AUTH_PW without authentication or nonce checks and stores them as reversible base64. This integrity-only issue (CVSS 5.3) allows overwriting the stored credential with attacker-chosen values, and in environments using WordPress Application Passwords, legitimate credentials sent to /wp-admin/ are silently captured into the database, though extracting them requires separate read access. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the All-in-One WP Migration and Backup WordPress plugin (versions 7.87 through 7.105) allows unauthenticated network attackers to create or append log files at arbitrary filesystem locations outside the plugin's intended storage directory. A publicly available proof-of-concept exploit exists via WPScan and the SSVC framework classifies exploitation as automatable, though EPSS at 0.16% (6th percentile) indicates limited observed opportunistic activity and no CISA KEV listing confirms active exploitation at time of analysis. The constrained write capability - log file creation and appending only, not arbitrary content injection - limits direct impact, but filesystem write access outside the web root could serve as a precursor step in chained attacks depending on server permissions.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin before 7.111 allows an authenticated user who has been granted the plugin's export capability - but not its import capability - to obtain an installation-wide secret and replay it against the plugin's import AJAX actions, importing an arbitrary site archive and gaining administrator access. Exploitation is not possible against a default install: it requires a non-default configuration in which an administrator has delegated the plugin's export capability to a role that does not also hold import capability, and the target site must run a version older than 7.111. Publicly available exploit code exists (reported via WPScan), making the flaw attractive to attackers who already hold a low-privileged account on a misconfigured site; the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (high impact, but with a hard configuration prerequisite).
SQL injection in the All-in-One WP Migration and Backup plugin (servmask, versions through 7.109) enables a two-stage attack path culminating in remote code execution. Insufficient parameterization in the archive restore database layer allows attackers to append arbitrary SQL queries and exfiltrate the ai1wm_secret_key from the WordPress database; once obtained, this key unlocks the plugin's restore endpoint and enables RCE. No KEV listing or EPSS data is available at time of analysis, but the direct RCE chaining potential makes this a high-priority remediation target for any WordPress site running the affected plugin.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.
Unauthenticated attackers can write to the WordPress database option ai1wm_auth_header in All-in-One WP Migration and Backup versions up to 7.110 by sending a crafted Authorization: Basic header to admin-ajax.php or admin-post.php, because the plugin's Ai1wm_Main_Controller::init() method on the admin_init hook reads PHP_AUTH_USER and PHP_AUTH_PW without authentication or nonce checks and stores them as reversible base64. This integrity-only issue (CVSS 5.3) allows overwriting the stored credential with attacker-chosen values, and in environments using WordPress Application Passwords, legitimate credentials sent to /wp-admin/ are silently captured into the database, though extracting them requires separate read access. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal in the All-in-One WP Migration and Backup WordPress plugin (versions 7.87 through 7.105) allows unauthenticated network attackers to create or append log files at arbitrary filesystem locations outside the plugin's intended storage directory. A publicly available proof-of-concept exploit exists via WPScan and the SSVC framework classifies exploitation as automatable, though EPSS at 0.16% (6th percentile) indicates limited observed opportunistic activity and no CISA KEV listing confirms active exploitation at time of analysis. The constrained write capability - log file creation and appending only, not arbitrary content injection - limits direct impact, but filesystem write access outside the web root could serve as a precursor step in chained attacks depending on server permissions.