All-in-One WP Migration and Backup vulnerabilities

Known security issues in the All-in-One WP Migration and Backup WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: all-in-one-wp-migration
Latest version: 7.112
Active installs: 5,000,000+
Known vulnerabilities: 25
Data updated: 2026-10-17 08:40 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 7.111 (2)

All-in-One WP Migration and Backup: Fixed in version 7.111
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header CVE-2026-89064 · Source	Medium	5.3	< 7.111	2026-09-17
All-in-One WP Migration and Backup <= 7.110 - Authenticated (Admin+) Privilege Escalation CVE-2026-81810 · Source	Not rated	-	< 7.111	2026-09-16

Fixed in version 7.110 (1)

All-in-One WP Migration and Backup: Fixed in version 7.110
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution CVE-2026-19949 · Source	High	8.8	< 7.110	2026-08-20

Fixed in version 7.108 (1)

All-in-One WP Migration and Backup: Fixed in version 7.108
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration and Backup < 7.108 - Authenticated (Administrator+) Remote Code Execution CVE-2026-17533 · Source	Not rated	-	< 7.108	2026-08-16

Fixed in version 7.106 (1)

All-in-One WP Migration and Backup: Fixed in version 7.106
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration and Backup <= 7.105 - Missing Authorization CVE-2026-12898 · Source	Not rated	-	< 7.106	2026-06-29

Fixed in version 7.98 (1)

All-in-One WP Migration and Backup: Fixed in version 7.98
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import CVE-2025-8490 · Source	Not rated	-	< 7.98	0000-00-00

Fixed in version 7.90 (1)

All-in-One WP Migration and Backup: Fixed in version 7.90
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All-in-One WP Migration Plugin <= 7.89 is vulnerable to PHP Object Injection CVE-2024-10942 · Source	High	7.5	< 7.90	2025-03-12

Fixed in version 7.87 (2)

All-in-One WP Migration and Backup: Fixed in version 7.87
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection CVE-2024-9162 · Source	High	7.2	< 7.87	2024-10-27
WordPress All-in-One WP Migration Plugin <= 7.86 is vulnerable to Sensitive Data Exposure CVE-2024-8852 · Source	Medium	5.3	< 7.87	2024-10-21

Fixed in version 7.63 (2)

All-in-One WP Migration and Backup: Fixed in version 7.63
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All-in-One WP Migration plugin <= 7.62 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability CVE-2022-2546 · Source	Medium	4.7	< 7.63	2022-08-23
All-in-One WP Migration <= 7.62 - Authenticated (Admin+) Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 7.63	2022-08-15

Fixed in version 7.59 (1)

All-in-One WP Migration and Backup: Fixed in version 7.59
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All in One WP Migration plugin <= 7.58 - Directory Traversal to File Deletion on Windows Hosts vulnerability CVE-2022-1476 · Source	Medium	6.5	< 7.59	2022-04-28

Fixed in version 7.41 (1)

All-in-One WP Migration and Backup: Fixed in version 7.41
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE CVE-2021-24216 · Source	High	7.2	< 7.41	2022-02-07

Fixed in version 7.15 (3)

All-in-One WP Migration and Backup: Fixed in version 7.15
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All-in-One WP Migration plugin <= 7.14 - Arbitrary Backup Download vulnerability No CVE assigned · Source	Not rated	-	< 7.15	2020-03-25
All-in-One WP Migration <= 7.14 - Unauthenticated Backup Download No CVE assigned · Source	Not rated	-	< 7.15	2020-01-20
All-in-One WP Migration < 7.15 - Arbitrary Backup Download No CVE assigned · Source	Not rated	-	< 7.15	-

Fixed in version 7.0 (3)

All-in-One WP Migration and Backup: Fixed in version 7.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress All-in-One WP Migration plugin <= 6.97 - Cross-Site Scripting (XSS) vulnerability (admin backend) No CVE assigned · Source	Not rated	-	< 7.0	2019-07-18
All-in-One WP Migration <= 6.97 - Authenticated Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 7.0	2019-07-18
All-in-One WP Migration < 7.0 - Authenticated Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 7.0	-

Fixed in version 6.46 (2)

All-in-One WP Migration and Backup: Fixed in version 6.46
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration <= 6.45 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 6.46	2017-06-20
All-in-One WP Migration < 6.46 - Reflected Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 6.46	-

Fixed in version 2.0.5 (3)

All-in-One WP Migration and Backup: Fixed in version 2.0.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Migration Plugin <= 2.0.4 - Unauthenticated Database Export No CVE assigned · Source	Not rated	-	< 2.0.5	2015-03-19
All-in-One WP Migration <= 2.0.4 - Missing Authorization to Database Export No CVE assigned · Source	Not rated	-	< 2.0.5	2015-03-19
All-in-One WP Migration < 2.0.5 - Unauthenticated Database Export No CVE assigned · Source	Not rated	-	< 2.0.5	-

Fixed in version 2.0.3 (1)

All-in-One WP Migration and Backup: Fixed in version 2.0.3
Vulnerability	Severity	CVSS	Affected versions	Published
All-in-One WP Migration <= 2.0.2 - Authorization Bypass to Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 2.0.3	2014-11-05

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.