Skip to content
Noroxi

All-in-One WP Migration and Backup

all-in-one-wp-migration · plugin

Known security vulnerabilities for All-in-One WP Migration and Backup. Find out in seconds which version runs on your site with WP Lens.

7 known vulnerabilities

4 exploitable without logging in · 3 with public exploit code · latest Sep 16, 2026

Listed on wordpress.org · latest 7.111 · last updated Sep 15, 2026 · 5M+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2026-19949unauthenticated≤ 7.109

    All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

    High 8.8

  • CVE-2024-10942unauthenticated · needs a click≤ 7.89

    All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection

    High 7.5

  • CVE-2024-9162admin≤ 7.86

    All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection

    High 7.2

  • CVE-2022-1476high privilege≤ 7.58

    All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts

    Medium 6.5

  • CVE-2026-89064unauthenticated≤ 7.110

    All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

    Medium 5.3

  • CVE-2024-8852unauthenticated≤ 7.86

    All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

    Medium 5.3

  • CVE-2025-8490admin≤ 7.97

    All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import

    Medium 4.4

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory