CVE-2022-1476: Servmask All-In-One Wp Migration

Medium severity, CVSS 6.5. EPSS: 46.3% chance of exploitation in the next 30 days.

The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key.

Affected products

• Servmask All-In-One Wp Migration: up to and including 7.58

Published 2022-05-10. Last modified 2026-06-17.