All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site's server, adding an arbitrary PHP code to it, which may make remote code execution possible.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| servmask | All-in-One WP Migration and Backup | up to 7.86 | — | No fix listed | CNA |
- All-in-One WP Migration and Backup Vendorservmask Affected up to 7.86 Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yaniiliev:all_in_one_wp_migration_and_backup:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:yaniiliev:all_in_one_wp_migration_and_backup:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9162
- 2026-10-03 Alias added: GHSA-qv4p-vph4-f9fc
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d97c3379-56c9-4261-9a70-3119ec121a40?source=cve
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/trunk/lib/controller/class-ai1wm-backups-controller.php#L60
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/trunk/lib/controller/class-ai1wm-export-controller.php#L36
- https://github.com/d0n601/CVE-2024-9162
- https://ryankozak.com/posts/CVE-2024-9162
More servmask vulnerabilities
- TI-2023-20896 Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins CVSS 3.1HIGH 7.3
- TI-2022-01350 All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts CVSS 3.1MEDIUM 6.6
- TI-2022-02352 All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS CVSS 3.1MEDIUM 4.7
- TI-2026-16173 SQL injection in servmask All-in-One WP Migration and Backup CVSS 3.1HIGH 8.8
- TI-2024-10143 All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection CVSS 3.1HIGH 7.5
- TI-2021-06508 All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE CVSS 3.1HIGH 7.2
Sources
- CVE-2024-9162 · CVE Program
- CVE-2024-9162 · NVD
- FIRST EPSS
- GHSA-qv4p-vph4-f9fc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences