PT-2026-61527 · WordPress · All-In-One Wp Migration/Backup

Jakub Herman · CVE-2026-12898 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.106

Description An issue exists where a user-supplied value is not properly sanitized before being used to construct a file path. This allows unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage directory.

Recommendations Update All-in-One WP Migration and Backup to version 7.106 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-12898

Affected Products

All-In-One Wp Migration/Backup

References · 3

• 🔥 https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12898 · Security Note
• https://twitter.com/VulmonFeeds/status/2079125301733249231 · Twitter Post