# CVE-2026-12898: ServMask All-in-One WP Migration path traversal in storage parameter

Source: https://junglewise.ai/threats/cve-2026-12898-servmask-all-in-one-wp-migration-path-traversal-in-storage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-12898 · Severity: info · CVSS 6.5 · Published 2026-07-20

All-in-One WP Migration and Backup is a popular WordPress plugin used to move and back up entire websites. A security flaw allows an unauthenticated attacker to create or modify log files in unintended locations on the web server. While the attacker cannot control the content of these files, this could be used to fill up disk space or interfere with other system operations.

Vendors: [ServMask](https://junglewise.ai/threats/vendors/servmask).

## Quick answers

**Is CVE-2026-12898 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12898 being exploited in the wild.

**How severe is CVE-2026-12898?** Informational severity, with a CVSS score of 6.5, published 20 July 2026.

**Which products and versions are affected?** ServMask All-in-One WP Migration < 7.106.

**Is there a fix for CVE-2026-12898?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12898 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12898?** Check whether you run ServMask All-in-One WP Migration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the All-in-One WP Migration and Backup plugin due to insufficient sanitization of the 'storage' parameter. By sending a specially crafted request that exceeds the PHP 'max_input_vars' limit, an attacker can trigger a PHP warning that is captured by the plugin's shutdown handler. This handler uses the unsanitized 'storage' parameter to construct a file path, allowing the attacker to write a log file (containing JSON-formatted error data) to arbitrary directories outside the intended storage folder. The attack is unauthenticated and does not require a valid secret key, though the resulting file extension is restricted to '.log'. This issue is fixed in version 7.106.

## Affected products

- ServMask All-in-One WP Migration and Backup < 7.106

## Timeline

- 2026-06-29: disclosed: Public disclosure by WPScan
- 2026-07-20: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/](https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/)

## Related threats

- [All-in-One WP Migration insufficient credential protection](https://junglewise.ai/threats/cve-2026-89064-all-in-one-wp-migration-insufficient-credential-protection)