CVE-2026-12898: Unknown All-In-One Wp Migration And Backup

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

Affected products

• Unknown All-In-One Wp Migration And Backup: from 7.87, before 7.106 (fixed in 7.106)

Published 2026-07-20. Last modified 2026-07-20.