Executive Summary

A vulnerability in the All-in-One WP Migration and Backup WordPress plugin before version 7.106 allows unauthenticated attackers to create or append log files in arbitrary locations. This vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. Affected versions are prior to 7.106.

Technical Analysis

The vulnerability is caused by improper sanitization of a user-supplied value used to build a file path. This allows unauthenticated attackers to create or append log files in arbitrary locations outside the intended storage directory. The vulnerability class is CWE-22, which refers to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

How It Gets Exploited

An unauthenticated remote attacker sends a crafted request to the plugin, supplying a malicious value that is not properly sanitized. This value is then used to build a file path, allowing the attacker to create or append a log file in an arbitrary location outside the intended storage directory. For example, an attacker could send a request with a filename parameter that includes directory traversal characters (e.g., '../') to write a log file to a sensitive location.

Impact Assessment

The All-in-One WP Migration and Backup WordPress plugin versions prior to 7.106 are affected. An attacker could exploit this vulnerability to create or append log files in arbitrary locations, potentially leading to information disclosure or further exploitation. The CVSS score for this vulnerability is 6.5, indicating a MEDIUM severity level.

Recommended Actions

Update the All-in-One WP Migration and Backup plugin to version 7.106 or later. Additionally, implement monitoring and logging to detect potential exploitation attempts. Consider implementing a Web Application Firewall (WAF) rule to block suspicious requests that may be attempting to exploit this vulnerability.

Sources

  • National Vulnerability Database (NVD)
  • WPScan