CVE-2026-12898 — All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

CVE-2026-12898

All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal PUBLISHED

Description (CNA)

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

Affected (CNA)

Vendor / product	Versions
Unknown / All-in-One WP Migration and Backup	affected 7.87 before 7.106

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.