Skip to content
Sign in
6.5 Medium

CVE-2026-12898 The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value…

Description

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

Affected products and versions

Product Affected versions Fixed in
All-in-One WP Migration and Backup 7.87 7.87 → < 7.106 7.106

Other CVEs of All-in-One WP Migration and Backup

The 3 CVEs of All-in-One WP Migration and Backup →
CVE-2026-81810 The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of… 7.2 High CVE-2026-17533 The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import… 7.2 High
Track this CVE