Executive brief
All-in-One WP Migration and Backup is a popular WordPress plugin used to move and back up entire websites. A security flaw allows an unauthenticated attacker to create or modify log files in unintended locations on the web server. While the attacker cannot control the content of these files, this could be used to fill up disk space or interfere with other system operations.
Technical details
A path traversal vulnerability exists in the All-in-One WP Migration and Backup plugin due to insufficient sanitization of the 'storage' parameter. By sending a specially crafted request that exceeds the PHP 'max_input_vars' limit, an attacker can trigger a PHP warning that is captured by the plugin's shutdown handler. This handler uses the unsanitized 'storage' parameter to construct a file path, allowing the attacker to write a log file (containing JSON-formatted error data) to arbitrary directories outside the intended storage folder. The attack is unauthenticated and does not require a valid secret key, though the resulting file extension is restricted to '.log'. This issue is fixed in version 7.106.
Affected products
- ServMask All-in-One WP Migration and Backup < 7.106
Timeline
- 2026-06-29: disclosed: Public disclosure by WPScan
- 2026-07-20: advisory: NVD publication date