A path‑traversal flaw in the All‑In‑One WP Migration and Backup plugin before 7.106 allows an attacker who is not logged in to supply a crafted file path. The plugin fails to sanitise the input used to build a log file name, permitting the creation or modification of files outside the intended logging directory. This can result in the placement of malicious code or alteration of critical configuration files.

Any WordPress installation that has the All‑In‑One WP Migration and Backup plugin installed with a version earlier than 7.106 is affected. No additional restrictions are described; the vulnerability is confined to the plugin’s logging mechanism.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation is unlikely. Nonetheless, the impact is serious because unauthenticated attackers can write arbitrary files, potentially installing backdoors, modifying configuration, or disrupting site operations. The attack is likely to be carried out via an unauthenticated HTTP request to the plugin's log‑creation endpoint carrying a path‑traversal payload. Successful exploitation could give the attacker persistent access or enable pivoting to other services.