Vulnerabilities

TI-2024-08218 CVE-2024-8852 · GHSA-v5vw-34cg-cmvf

All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

LOW 32

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01197 Published 2024-10-22 No fix listed CWE-200

TI-2022-02352 CVE-2022-2546 · GHSA-qfjr-7vg6-v99x

All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS

MEDIUM 55

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitt…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.01204 Published 2023-02-02 Fixed in 7.63

TI-2022-01350 CVE-2022-1476 · GHSA-qjj4-mxpm-p3m8

All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts

MEDIUM 59

The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, a…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.46268 Published 2022-05-10 No fix listed CWE-22

Vulnerabilities

Filters

All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS

All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts