medium6.5
CVE-2026-12898
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, all…
Impact
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Affected products
| Product | Affected versions |
|---|---|
| All-In-One WP Migration And Backup WordPress Plugin | before 7.106 |
Versions were read from the advisory text. No structured product data has been published for this record yet.