All-in-One WP Migration and Backup WordPress Plugin Path Traversal Vulnerability Allowing Unauthenticated Arbitrary Log File Write

A vulnerability exists in the All-in-One WP Migration and Backup WordPress plugin in versions prior to 7.106. The issue arises because the plugin fails to properly sanitize user-supplied values before using them to construct file paths. This flaw allows unauthenticated attackers to create or append log files in arbitrary locations outside the plugin's designated storage directory.

Impact

Exploitation of this vulnerability leads to unauthorized creation or modification of log files in sensitive areas of the file system, potentially overwriting important data or causing disruption.

Reproduction

The vulnerability can be reproduced with a single unauthenticated request. The path traversal is executed through the 'storage' parameter. By padding the request body with additional parameters that exceed the host's 'max_input_vars' limit, a PHP warning is triggered. This warning allows the attacker to bypass the plugin's secret key check and write a file to the specified location. The written file can then be accessed through the web server.

Remediation

Users are advised to update the All-in-One WP Migration and Backup WordPress plugin to version 7.106 or later.