CVE-2022-1476: All-in-One WP Migration plugin path traversal allows arbitrary file deletion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityExploitation requires administrative access or the site secret key, which limits reach, but successful abuse causes high integrity and availability impact and the plugin is widely deployed.

What it is

The All-in-One WP Migration WordPress plugin fails to properly validate file paths in ~/lib/model/class-ai1wm-backups.php, allowing directory traversal. Versions up to and including 7.58 are affected, and a successful attack deletes arbitrary files on the server, which can break the site or remove data.

Impact

An attacker can delete arbitrary files on the WordPress host, causing data loss, denial of service, or removal of security-relevant files. The CVSS vector shows high integrity and availability impact with no confidentiality impact.

Attack surface

The flaw is reachable over the network through the plugin's backup handling code. It requires high privileges: an administrative user or anyone holding the site's secret key, and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware association is documented. EPSS is high at roughly 0.479 (98.8th percentile), and references include a patch changeset plus Wordfence advisories, but no public exploit tag is present.

What to do

• Update the All-in-One WP Migration plugin to a version newer than 7.58, which contains the patch.
• If immediate patching is not possible, disable or remove the plugin until it can be updated.
• Rotate the site's secret key and review administrative accounts, since access to the secret key or admin role is sufficient to exploit this.
• Restrict and audit administrator-level accounts, applying least privilege to reduce who can reach the vulnerable backup functionality.
• Maintain offline backups so deleted files can be restored if exploitation occurs.

Detection

• Monitor plugin and web server logs for requests to All-in-One WP Migration backup endpoints containing traversal sequences such as ../.
• Alert on unexpected deletion or disappearance of files in WordPress directories and the web root.
• Audit changes to administrator accounts and secret key usage for signs of unauthorized access.
• Watch for file integrity monitoring alerts on core WordPress, plugin, and configuration files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.