CVE-2022-1476mediumCWE-22

CVE-2022-1476: falha de média gravidade em servmask All-in-One WP Migration and Backup

All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar All-in-One WP Migration and Backup

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

25Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.6epss 46%
The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
servmask · All-in-One WP Migration and Backup
CVEs relacionadas — servmask All-in-One WP Migration and Backup

No mesmo produto, das mais perigosas para as menos.

CVE-2024-9162HIGHAll-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code InjectionEPSS 2.7%CVE-2024-8852MEDIUMAll-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error LogsEPSS 1.2%CVE-2026-19949HIGHAll-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code ExecutionEPSS 1.0%CVE-2024-10942HIGHAll in One WP Migration <= 7.89 - Unauthenticated PHP Object InjectionEPSS 0.6%CVE-2026-89064MEDIUMAll-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic HeaderEPSS 0.5%CVE-2025-8490MEDIUMAll-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via ImportEPSS 0.2%