CVE-2026-12898 PUBLISHED

All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

Assigner: WPScan
Reserved: 22.06.2026 Published: 20.07.2026 Updated: 20.07.2026

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

Product Status

Vendor Unknown
Product All-in-One WP Migration and Backup
Versions Default: unaffected
  • affected from 7.87 to 7.106 (excl.)

Credits

  • Jakub Herman finder
  • WPScan coordinator

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE