The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site's server, adding an arbitrary PHP code to it, which may make remote code execution possible.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| All In One Wp Migration Plugin | — | Update all-in-one-wp-migration plugin to version 7.87, or a newer patched version | May 15, 2025 | Oct 27, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub