Now officially on WordPress.org

CVE Database / CVE-2026-12898

CVE

CVE-2026-12898 — All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.106

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-12898 All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.106 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Unknown < 7.106 7.106 2026-06-29 —

CVE-2026-12898

A vulnerability exists in versions of the All-in-One WP Migration and Backup plugin for WordPress prior to 7.106, where user-supplied input is not adequately sanitized before being used to construct a file path. This can enable unauthenticated attackers to create or append log files in arbitrary locations outside the intended storage directory.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings