All-in-One WP Migration and Backup vulnerabilities

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL injection in the archive restore functionality in all versions up to and including 7.109 due to insufficient escaping and lack of query preparation. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database, including the `ai1wm_secret_key`, and achieving remote code execution.

The All-in-One WP Migration and Backup WordPress plugin before version 7.108 does not restrict migration import to network administrators on multisite, allowing a subsite admin to execute arbitrary PHP code across the entire network.

The All-in-One WP Migration and Backup WordPress plugin before version 7.106 does not properly sanitize a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.