CVE-2022-1476: All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts
The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1476?
CVE-2022-1476 is classified as a high-severity vulnerability due to the potential for arbitrary file deletion.
How do I fix CVE-2022-1476?
To fix CVE-2022-1476, update the All-in-One WP Migration plugin to version 7.59 or later.
Who is affected by CVE-2022-1476?
CVE-2022-1476 affects users of the All-in-One WP Migration plugin for WordPress versions up to and including 7.58.
What type of attack does CVE-2022-1476 allow?
CVE-2022-1476 allows for arbitrary file deletion, which can be exploited via directory traversal attacks.
Is CVE-2022-1476 exploitable by non-administrative users?
CVE-2022-1476 is primarily exploitable by administrative users due to the permissions required to perform file deletion.