High-Level vulnerability in the All-in-One WP Migration and Backup Plugin

High-level vulnerability was recently discovered and fixed in the All-in-One WP Migration and Backup plugin, which is set on over five million sites. This vulnerability does not require the authentication of the user, which facilitates the process of compromising the website.

The vulnerability was grade 7.5 (high), which is below the highest level of seriousness that has a "critical" label.

Vulnerability is called unprotected PHP injection of objects. But this specific vulnerability is less serious than the usual unprotected PHP injection of objects where the attacker can directly operate the vulnerability.

This vulnerability requires that the user with the rights of the administrator export and restore the backup with a plugin to activate operation.

If the appropriate conditions are fulfilled, the attacker can delete files, access confidential information and start the malicious code.

• 📌 The vulnerability found in the All-in -one WP Migration and Backup plugin
• 📌 Vulnerability does not require user authentication
• 📌 Vulnerability received a grade of seriousness 7.5
• 📌 vulnerability requires an export administrator and reserve backup