HTTP: WordPress All-in-One WP Migration Plugin Backups Directory Traversal

This signature detects attempts to exploit a known vulnerability against WordPress All-in-One WP Migration Plugin Backups. A successful attack can lead to directory traversal and arbitrary code execution.

Extended Description

The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key.

Affected Products

Servmask all-in-one_wp_migration

References

CVE: CVE-2022-2863

URL: https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1476 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2715609%40all-in-one-wp-migration&new=2715609%40all-in-one-wp-migration&sfp_email=&sfph_mail= https://en-ca.wordpress.org/plugins/wpvivid-backuprestore/#developers https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5

Short Name

HTTP:DIR:WP-AIO-MIGRATION-DIR

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: WordPress All-in-One WP Migration Plugin Backups Directory Traversal

Extended Description

Affected Products

References

Found a potential security threat?