CVE-2022-1476mediumCWE-22

CVE-2022-1476: fallo de gravedad media en servmask All-in-One WP Migration and Backup

All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear All-in-One WP Migration and Backup

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

25Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.6epss 46%
The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
servmask · All-in-One WP Migration and Backup
CVEs relacionadas — servmask All-in-One WP Migration and Backup

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-9162HIGHAll-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code InjectionEPSS 2.7%CVE-2024-8852MEDIUMAll-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error LogsEPSS 1.2%CVE-2026-19949HIGHAll-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code ExecutionEPSS 1.0%CVE-2024-10942HIGHAll in One WP Migration <= 7.89 - Unauthenticated PHP Object InjectionEPSS 0.6%CVE-2026-89064MEDIUMAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic HeaderEPSS 0.5%CVE-2025-8490MEDIUMAll-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via ImportEPSS 0.2%