{"id":"CVE-2026-12898","aliases":["EUVD-2026-45884","GHSA-8vwp-3x94-mq44"],"status":"published","title":"All-in-One WP Migration and Backup \u003c 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01352,"percentile":0.7179,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-07-20T06:00:03Z","modified":"2026-07-20T20:39:31Z","exploits":[{"source":"nuclei","id":"CVE-2026-12898","title":"All-in-One WP Migration and Backup \u003c 7.106 - Arbitrary Log File Write","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-12898.yaml"}],"products":[{"vendor":"servmask","product":"all-in-one wp migration and backup"},{"vendor":"unknown","product":"all-in-one wp migration and backup"}],"references":[{"url":"https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12898"},{"url":"https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa"},{"url":"https://github.com/advisories/GHSA-8vwp-3x94-mq44"}],"sources":{"cve":[{"id":"CVE-2026-12898","title":"All-in-One WP Migration and Backup \u003c 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.","status":"published","published":"2026-07-20T06:00:03.782Z","modified":"2026-07-20T15:04:20.034Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-45884","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.","status":"published","published":"2026-07-20T06:00:03Z","modified":"2026-07-20T15:04:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:19:49.035342Z"}],"ghsa":[{"id":"GHSA-8vwp-3x94-mq44","title":"The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a...","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.","status":"published","published":"2026-07-20T09:31:07Z","modified":"2026-07-20T18:33:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:09:36.920272Z"}],"nvd":[{"id":"CVE-2026-12898","description":"The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.","status":"published","published":"2026-07-20T07:16:35.087Z","modified":"2026-07-20T20:39:31.217Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:31.024898Z"}]}}