Security Alert Summary
The All-in-One WP Migration and Backup WordPress plugin contains an input sanitization flaw that allows unauthenticated attackers to create or append a log file in arbitrary locations outside the plugin’s intended storage directory. An attacker can exploit a user-supplied value that is used to build a filesystem path, enabling file creation or modification outside the expected folder.
CVE Details
- CVE ID:
CVE-2026-12898 - Affected component: All-in-One WP Migration and Backup WordPress plugin
- Affected versions: Versions less than 7.106 (example entry: 7.87 is marked affected)
- Published: July 20, 2026 at 07:16:35 AM UTC
- Last modified: July 20, 2026 at 04:16:54 PM UTC
- CVSS v3.1: Base score 6.5, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Authentication / privileges / user interaction: No authentication or privileges required (PR:N); no user interaction required (UI:N)
- Primary impact: Confidentiality: None (C:N); Integrity: Low (I:L); Availability: Low (A:L)
- Weakness: CWE-22 (Improper Restriction of Filename or Path)
Technical Details
The plugin does not properly sanitise a user-supplied value before using it to build a file path. Because the input is used directly in path construction, an unauthenticated attacker can specify a path that places a new log file, or appends data to an existing file, in locations outside the plugin’s intended storage directory.
This is a path-handling validation issue (CWE-22) where the absence of canonicalization or strict path checks allows traversal or arbitrary path construction. The CVE description reports creation or appending of log files as the impact; no specific functions or REST endpoints are named in the provided data.
Impact is limited to low integrity and availability effects as described: an attacker can modify or create files (log files) outside the intended area, which could alter log contents or consume filesystem resources. There is no CVE-provided indication of direct confidentiality loss from this issue.
How This Could Impact Your Website
Consider a site with multiple WordPress users: the site owner, internal staff who manage content, and an external contractor who performs occasional maintenance. An unauthenticated attacker exploiting this issue could write or append files on the server in locations the plugin did not intend to use. Practical consequences include modified or misleading log entries, or unexpected files placed in directories that affect site behavior or diagnostics.
Although the CVSS data indicates no direct confidentiality impact, if logs or other writable files contain business or contact information, manipulated or exposed logs could indirectly increase the risk of targeted phishing or social engineering against staff. If you are not sure whether your site stores sensitive data in logs or the plugin is configured in a way that might broaden impact, professional review may be useful.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles that can be abused.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and server logs for unusual file creations, unexpected log entries, or other abnormal behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
