All-in-One WP Migration, b926f365330380d31ba15f85ecced690445a0a33

CVE, Research URL: b926f365330380d31ba15f85ecced690445a0a33
Home page URL: Security reports for All-in-One WP Migration
Application: All-in-One WP Migration
Published on: Jan 20, 2020
Research Description: All-in-One WP Migration and Backup [all-in-one-wp-migration] < 7.15 All-in-One WP Migration <= 7.14 - Unauthenticated Backup Download The All-in-One WP Migration plugin for WordPress is vulnerable to unauthenticated arbitrary back-up downloads due to insufficient filename randomization that made it possible for unauthenticated attackers to brute force back-up filenames in unique situations in versions up to, and including, 7.14. This would make it possible for unauthenticated attackers to discover information from files contained in the back-ups that could be used to aid further attacks or lead to simply sensitive information disclosure.
Affected versions: max 7.15.
Status: vulnerable