CVE-2024-9162 json
All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection
published 2024-10-28 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-49764
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site's server, adding an arbitrary PHP code to it, which may make remote code execution possible.
Patch / fix
- servmask all-in-one_wp_migration 7.87
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
2.74% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
- servmask All-in-One WP Migration and Backup
- yaniiliev all_in_one_wp_migration_and_backup
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/d97c3379-56c9-4261-9a70-3119ec121a40?source=cve
- plugins.trac.wordpress.org /browser/all-in-one-wp-migration/trunk/lib/controller/class-ai1wm-backups-controller.php#L60
- plugins.trac.wordpress.org /browser/all-in-one-wp-migration/trunk/lib/controller/class-ai1wm-export-controller.php#L36
- github.com /d0n601/CVE-2024-9162
- ryankozak.com /posts/CVE-2024-9162
Sources
- CVE List CVE-2024-9162
- NVD CVE-2024-9162
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.