CVE-2024-8852: All-in-One WP Migration Information Disclosure

CVE-2024-8852 Overview

CVE-2024-8852 affects the All-in-One WP Migration and Backup plugin for WordPress, developed by ServMask. The plugin exposes log files in a publicly accessible location across all versions up to and including 7.86. Unauthenticated attackers can read these log files directly over the network and extract sensitive information, including full server paths. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. With more than five million active installations of the plugin, the attack surface is broad, even though exploitation only reveals informational data rather than granting code execution.

Critical Impact
Unauthenticated remote attackers can retrieve log files containing full filesystem paths and other environmental data, aiding reconnaissance for follow-on attacks against the WordPress host.

Affected Products

ServMask All-in-One WP Migration and Backup plugin for WordPress
All plugin versions up to and including 7.86
WordPress installations running the free edition of the plugin

Discovery Timeline

2024-10-22 - CVE-2024-8852 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8852

Vulnerability Analysis

The plugin writes operational log files to a directory served by the web server without access controls. Any remote user who knows or guesses the log file URL can retrieve its contents over HTTP or HTTPS. The exposed data typically includes absolute filesystem paths generated during backup and migration operations. While the disclosure does not directly compromise integrity or availability, path disclosure supports reconnaissance for path traversal, local file inclusion, and privilege escalation chains. The relevant plugin logic can be reviewed in the WordPress plugin source at tag 7.86.

Root Cause

The plugin stores log files inside a web-accessible directory and does not enforce authentication, deny-by-default access rules, or randomized filenames. There is no .htaccess denial, no PHP-based access check, and no rewrite rule preventing direct file retrieval. This design choice conflicts with the WordPress guidance to keep operational artifacts outside publicly reachable paths.

Attack Vector

Exploitation requires only network access to the target site. An attacker issues an HTTP GET request against the known log file path under the plugin's storage directory. Because the request requires no authentication and no user interaction, it can be automated at scale across WordPress hosts. The response body reveals path information the attacker can use to map the environment. Refer to the Wordfence vulnerability record for additional context.

No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities entry exists for this issue at the time of writing.

Detection Methods for CVE-2024-8852

Indicators of Compromise

Unauthenticated HTTP GET requests targeting files under /wp-content/ai1wm-backups/ or plugin log paths
Access log entries showing 200 OK responses for .log or .txt files inside the plugin storage directory
Repeated requests from a single source enumerating filenames within the plugin's backup directory

Detection Strategies

Audit the installed version of the All-in-One WP Migration plugin and flag any instance at 7.86 or earlier
Review web server access logs for direct requests to plugin log files that returned successful responses
Compare current directory listings under wp-content/ai1wm-backups/ against expected file inventories

Monitoring Recommendations

Alert on anonymous access patterns to backup or log directories inside wp-content/plugins/all-in-one-wp-migration/ and related storage paths
Monitor for scanner-style user agents probing WordPress plugin paths
Track repeated 404 responses followed by successful retrievals, indicating filename enumeration

How to Mitigate CVE-2024-8852

Immediate Actions Required

Update the All-in-One WP Migration and Backup plugin to a version released after 7.86 that includes the vendor fix
Remove or relocate any existing log files from web-accessible directories after upgrading
Restrict access to plugin storage directories using web server rules until patching completes

Patch Information

ServMask addressed the exposure in a subsequent plugin release. The fix is reflected in the WordPress plugin changeset log. Administrators should confirm they are running a patched build via the WordPress plugin admin screen.

Workarounds

Add web server rules to deny direct requests for .log files inside wp-content/ai1wm-backups/
Deploy a .htaccess or Nginx location block that blocks anonymous access to the plugin's storage directory
Delete stale log files that may already have been enumerated by scanners
Place a web application firewall rule in front of the site to block unauthenticated access to plugin log paths

bash

# Apache .htaccess example placed in wp-content/ai1wm-backups/
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/ai1wm-backups/.*\.(log|txt)$ {
    deny all;
    return 403;
}