Description
WordPress Plugin All-in-One WP Migration is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently guess and download backup files. WordPress Plugin All-in-One WP Migration version 7.14 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 7.15 or latest
References
https://vavkamil.cz/2020/03/25/all-in-one-wp-migration/
https://plugins.svn.wordpress.org/all-in-one-wp-migration/trunk/readme.txt
Related Vulnerabilities
Oracle HTTP Server Improper Input Validation Vulnerability (CVE-2020-29507)
WordPress Plugin Arigato Autoresponder and Newsletter Remote Code Execution (2.5.1.9)
WordPress Plugin Pinterest 'Pin It' Button Cross-Site Scripting (2.0.8)
Oracle JRE CVE-2013-2433 Vulnerability (CVE-2013-2433)
PHP Use of Insufficiently Random Values Vulnerability (CVE-2023-3247)