PT-2024-39276 · WordPress · All-In-One Wp Migration/Backup

Villu Orav + 1 · Published 2024-10-22 · Updated 2026-04-14 · CVE-2024-8852

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: All-in-One WP Migration and Backup plugin for WordPress versions up to, and including, 7.86

Description: The issue allows unauthenticated attackers to view potentially sensitive information, such as full paths, contained in publicly exposed log files. This is possible due to Sensitive Information Exposure in the plugin.

Recommendations: For versions up to, and including, 7.86, update to a version that fixes the Sensitive Information Exposure issue to prevent unauthenticated attackers from viewing sensitive information. As a temporary workaround, consider restricting access to the publicly exposed log files until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-8852

Affected Products

All-In-One Wp Migration/Backup

References · 10

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168605%40all-in-one-wp-migration&new=3168605%40all-in-one-wp-migration&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-8852 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8852 · Vendor Advisory
• https://twitter.com/CVEnew/status/1848670000439291943 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2043877012071182822 · Twitter Post
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.86/functions.php#L297 · Note
• https://t.me/cvedetector/8593 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1989272126227128686 · Twitter Post
• https://t.me/cvenotify/99054 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c4901d9d-7b37-40d5-a42b-59c80bbbe8ff?source=cve · Note