CVE-2024-8852mediumobserved exploitationCWE-200

CVE-2024-8852: medium-severity vulnerability in servmask All-in-One WP Migration and Backup

All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

Published · Updated

Follow this CVE+ Monitor All-in-One WP Migration and Backup

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 5.3epss 1.2%
from disclosure to weapon
Published on NVDOct 22
VulnCheck+402d
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full paths contained in the exposed log files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
servmask · All-in-One WP Migration and Backup
Related CVEs — servmask All-in-One WP Migration and Backup

In the same product, most dangerous first.

CVE-2022-1476MEDIUMAll-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows HostsEPSS 46.3%CVE-2024-9162HIGHAll-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code InjectionEPSS 2.7%CVE-2026-19949HIGHAll-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code ExecutionEPSS 1.0%CVE-2024-10942HIGHAll in One WP Migration <= 7.89 - Unauthenticated PHP Object InjectionEPSS 0.6%CVE-2026-89064MEDIUMAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic HeaderEPSS 0.5%CVE-2025-8490MEDIUMAll-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via ImportEPSS 0.2%