What is CVE-2026-12898?

CVE-2026-12898 is a medium-severity vulnerability in All-in-one Wp Migration And Backup, classified under Path Traversal. CVSS score: 6.5/10. Published 2026-07-20.

How severe is CVE-2026-12898?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Path Traversal in All-in-one Wp Migration And Backup

CVE-2026-12898

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary loca…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

Affected products

Unknown All-in-one Wp Migration And Backup — versions 7.87

Weakness classification (CWE)

CWE-22 — Path Traversal

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-12898?: CVE-2026-12898 is a medium-severity vulnerability in All-in-one Wp Migration And Backup, classified under Path Traversal. CVSS score: 6.5/10. Published 2026-07-20.
How severe is CVE-2026-12898?: Medium severity. CVSS v3 base score is 6.5 out of 10.