CVE-2021-24216: Servmask One-Stop Wp Migration

High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days.

The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations.

Affected products

• Servmask One-Stop Wp Migration: before 7.41 (fixed in 7.41)

Published 2022-03-07. Last modified 2026-06-17.