Arbitrary PHP Code Execution in All-in-One WP Migration WordPress Plugin

Executive Summary

This vulnerability affects the All-in-One WP Migration and Backup WordPress plugin before version 7.108. In multisite installations, a subsite administrator can exploit the plugin's import feature to run arbitrary PHP code across the entire network, bypassing normal tenant separation.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the All-in-One WP Migration plugin. If it is below 7.108, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Useful 0 Not Useful 0

Impact Analysis

If you use a multisite WordPress setup with this plugin, a compromised subsite administrator could gain control over the entire network, leading to data breaches, unauthorized access, or complete site takeover. Even non-admin users with some privileges might exploit this if the plugin is outdated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations may face fines or legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update the All-in-One WP Migration plugin to version 7.108 or later immediately. Restrict subsite administrator privileges to prevent unauthorized access. Monitor network activity for suspicious PHP code execution attempts.

Useful 0 Not Useful 0