/Vulnerability Library

All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write

CVE-2026-12898
Verified

Description

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage directory.

Severity

Medium

CVSS Score

6.5

Exploit Probability

1%

Affected Product

all-in-one-wp-migration

Published Date

July 23, 2026

Template Author

iamatownboy

CVE-2026-12898.yaml
6.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVE ID:
cve-2026-12898
CWE ID:
cwe-22

References

https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/https://wordpress.org/plugins/all-in-one-wp-migration/https://nvd.nist.gov/vuln/detail/CVE-2026-12898

Remediation Steps

Update All-in-One WP Migration and Backup to version 7.106 or later.