CVE-2026-12898
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The All-in-One WP Migration and Backup WordPress plugin before version 7.106 does not properly sanitize a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Risk Assessment
The risk involves the ability to write files to arbitrary server locations, potentially leading to privilege escalation, malicious code execution, or system integrity compromise.
Recommendation
It is recommended to immediately update the All-in-One WP Migration and Backup plugin to version 7.106 or later, which includes the security fix.
Other vulnerabilities in All-in-One WP Migration and Backup
See all- CVE-2026-19949High
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL injection in the archive restore functionality in all versions up to and including 7.109 due to insufficient escaping and lack of query preparation. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database, including the `ai1wm_secret_key`, and achieving remote code execution.
- CVE-2026-17533High
The All-in-One WP Migration and Backup WordPress plugin before version 7.108 does not restrict migration import to network administrators on multisite, allowing a subsite admin to execute arbitrary PHP code across the entire network.
Original NVD description (English source)
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.