Arbitrary PHP Code Injection Vulnerability in All-in-One WP Migration and Backup Plugin

CVE-2024-9162

Summary

The All-in-One WP Migration and Backup plugin for WordPress contains a vulnerability that allows authenticated attackers to inject arbitrary PHP code due to insufficient file type validation during the export process. This flaw affects all versions up to and including 7.86. Attackers with Administrator-level access can exploit this vulnerability by creating an export file with a .php extension on the server, thus executing arbitrary PHP code and potentially gaining remote command execution capabilities.

References