CVE

CVE-2026-12898

6.5

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

all-in-one wp migration and backup

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage directory. References: https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/ https://wordpress.org/plugins/all-in-one-wp-migration/ https://nvd.nist.gov/vuln/detail/CVE-2026-12898 Remediation: Update All-in-One WP Migration and Backup to version 7.106 or later.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: all-in-one wp migration and backup

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →