CVE-2026-12898
Deferred Deferred - Pending Action

Unauthenticated Path Traversal in All-in-One WP Migration Plugin

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: WPScan

Description
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-12898
EUVD
EUVD-2026-45884

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
servmask all-in-one_wp_migration_and_backup to 7.106 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the All-in-One WP Migration and Backup WordPress plugin before version 7.106. It allows unauthenticated attackers to create or append log files in arbitrary locations outside the plugin's intended storage directory by exploiting improper sanitization of user-supplied input in the storage parameter.

Detection Guidance

Check for unexpected .log files in web-accessible directories like /wp-content/uploads/ or other locations outside the plugin's storage directory. Look for files modified around the time of suspicious activity or containing PHP error messages.

Impact Analysis

An attacker could write log files to sensitive directories like /wp-content/uploads/, potentially overwriting existing files or storing malicious content. This could lead to website defacement, disruption of services, or further exploitation of the system.

Compliance Impact

This vulnerability could lead to unauthorized file creation in sensitive directories, potentially exposing sensitive data or violating data integrity requirements under GDPR or HIPAA. Unauthorized file access or modification may result in compliance violations.

Mitigation Strategies

Update the All-in-One WP Migration and Backup plugin to version 7.106 or later immediately. If updating is not possible, consider disabling the plugin temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart