Now officially on WordPress.org

CVE Database / CVE-2022-1476

CVE · Medium

CVE-2022-1476 — All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.59

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-1476 All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.59 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Medium 6.5 < 7.59 7.59 2022-04-28 —

CVE-2022-1476

The All-in-One WP Migration plugin for WordPress before version 7.59 contains a directory traversal vulnerability that allows deletion of arbitrary files because the ~/lib/model/class-ai1wm-backups.php file does not properly validate file paths. Attackers with administrator privileges or knowledge of the site's secret key can exploit this flaw to remove files from the server.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings