All-in-One WP Migration and Backup

All-in-One WP Migration and Backup has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 16 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 7 high. 2022 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (31%). Other recurring categories include Code Injection, Path Traversal.

Every one of the 16 issues recorded for All-in-One WP Migration and Backup has a vendor fix available, so running the current release closes all known holes.

14 independent researchers contributed these findings, one record each. All-in-One WP Migration and Backup is installed on roughly 5,000,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891007.01.2014Today05.11.20148.8All-in-One WP Migration <= 2.0.2 - Authorization Bypass to Arbitrary File Upload CVSS 8.8 · 05.11.201419.03.20157.5All-in-One WP Migration <= 2.0.4 - Missing Authorization to Database Export CVSS 7.5 · 19.03.201520.06.20176.1All-in-One WP Migration <= 6.45 - Reflected Cross-Site Scripting CVSS 6.1 · 20.06.201718.07.20195.5All-in-One WP Migration <= 6.97 - Authenticated Stored Cross-Site Scripting CVSS 5.5 · 18.07.201920.01.20205.9All-in-One WP Migration <= 7.14 - Unauthenticated Backup Download CVSS 5.9 · 20.01.202007.02.20227.2All-in-One WP Migration <= 7.40 - Authenticated (Admin+) Arbitrary File Upload CVSS 7.2 · 07.02.202228.04.20226.6All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts CVSS 6.6 · 28.04.202215.08.20225.5All-in-One WP Migration <= 7.62 - Authenticated (Admin+) Cross-Site Scripting CVSS 5.5 · 15.08.202223.08.20226.1All-in-One WP Migration <= 7.62 - Unauthenticated Reflected Cross-Site Scripting CVSS 6.1 · 23.08.202221.10.20245.3All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs CVSS 5.3 · 21.10.202427.10.20247.2All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection CVSS 7.2 · 27.10.202412.03.20257.5All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection CVSS 7.5 · 12.03.202526.08.20254.4All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import CVSS 4.4 · 26.08.202529.06.20265.3All-in-One WP Migration and Backup <= 7.105 - Missing Authorization CVSS 5.3 · 29.06.202620.08.20267.2All-in-One WP Migration and Backup < 7.108 - Authenticated (Administrator+) Remote Code Execution CVSS 7.2 · 20.08.202624.08.20268.8All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution CVSS 8.8 · 24.08.2026

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

16

Get automatic notifications for all All-in-One WP Migration and Backup vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-19949

All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

Read the full analysis

Vulnerability Records

16 records
2026-08-24 22:05CVE-2026-19949
8.8
High
Jack TaylorYes
2026-08-20 00:00CVE-2026-17533
7.2
High
Mohamed BassiaYes
2026-06-29 00:00CVE-2026-12898
5.3
Medium
Jakub HermanYes
2025-08-26 10:28CVE-2025-8490
4.4
Medium
AlexHenryYes
2025-03-12 00:00CVE-2024-10942
7.5
High
WebbernautYes
2024-10-27 00:00CVE-2024-9162
7.2
High
Ryan KozakYes
2024-10-21 16:33CVE-2024-8852
5.3
Medium
villu164Yes
2022-08-23 00:00CVE-2022-2546
6.1
Medium
AnonymousYes
2022-08-15 00:00N/A
5.5
Medium
AnonymousYes
2022-04-28 00:00CVE-2022-1476
6.6
Medium
haidv35Yes
Showing 1–10 of 16 reports
All-in-One WP Migration and Backup banner
Latestv7.110

All-in-One WP Migration and Backup

ServMask

Author

ServMask

4.5(7,665)
90/100
Last Updated
2026-08-20 (24d ago)
Active Installs
5,000,000+
Downloads
187,450,717
Requires WP
3.3+
Requires PHP
5.3+
Tested up to
WP 7.1
Created
2014-01-07 (13y ago)

The Most Trusted WordPress Migration & Backup Plugin Since 2013 All-in-One WP Migration is the gold standard for WordPress site migration and backup, used by over 60 million websites worldwide – from small blogs to Fortune 500 companies and government agencies. Whether you need to migrate WordPress to a new host, create a full site backup, or restore a previous backup, our plugin offers enterprise-grade reliability with beginner-friendly simplicity. Why Choose All-in-One WP Migration? Effortless Migration: Migrate your entire site with a single click – including database, media, themes, and plugins One-Click Backup: Create a complete WordPress backup before you migrate, so you can restore anytime Zero Downtime: Complete your migration with no service interruptions Universal Compatibility: Migrate between any hosting providers – from budget shared hosting to high-end dedicated servers Technical Excellence: Engineered for reliability with memory-efficient processing (512KB chunks), ideal for resource-limited environments No Technical Skills Required: Intuitive interface lets anyone migrate or backup a WordPress site without technical expertise Cross-Database Support: Migrate seamlessly between MySQL, MariaDB, and SQLite databases Secure & Reliable: Trusted by Boeing, NASA, Harvard, Stanford, Automattic, and government agencies worldwide How to Migrate WordPress – Simple as 1-2-3: Install the migration plugin on your source and destination sites Backup & Export your site to a .wpress backup file with one click Import & Migrate using our drag-and-drop importer on your destination site For Developers & Power Users: Advanced Find & Replace: Control exactly what changes when you migrate Selective Migration & Backup: Include or exclude specific content types from your migration or backup PHP 5.3-8.4 Compatibility: Works across virtually all hosting environments Custom WPress Format: Our optimized archive format ensures data integrity Hook System: Extensive API for custom integration and workflows Command-Line Support: Automate migrations and backups via WP-CLI Premium Extensions: Enhance your migration and backup workflow with our premium extensions: Unlimited Migration Size: Migrate sites of any size with no file limits Cloud Backup & Migration: Backup and migrate directly to/from Dropbox, Google Drive, OneDrive, and more Multisite Migration: Migrate complex WordPress multisite networks Scheduled Backups: Automated, recurring WordPress backups on your schedule Database Filtering: Exclude specific tables or data from your migration or backup Features Spotlight: WCAG 2.1 AA Level accessibility compliance Mobile-responsive interface Browse WPRESS files online or extract locally Automatic URL and path replacement during migration WordPress Playground integration – migrate between SQLite and MySQL Regular bi-weekly updates ensuring your backup and migration plugin stays compatible Available in 50+ languages including Japanese Trusted by the Government and Big Corporations: Many enterprise customers, government organizations, and universities use, love, and trust All-in-One WP Migration. Here are some: Boeing, NASA, VW, IBM, Harvard University, Stanford University, Lego, P&G, Automattic, State of California, State of Hawaii. This broad adoption demonstrates how safe, reliable and adaptable this WordPress migration and backup plugin is for any website migration need. Update Frequency: Our team is dedicated to keeping this WordPress migration and backup plugin up-to-date and secure. We release updates every two weeks or at least once a month, ensuring your migration and backup workflows remain compatible with the latest WordPress versions, including beta releases. Our proactive testing and feedback to the WordPress core team help in preemptively addressing any potential issues, so you can always migrate and backup with confidence. Full Compatibility and Support: All-in-One WP Migration has been extensively tested and confirmed to be compatible with most WordPress plugins and themes, so you can migrate and backup without worrying about conflicts. This means you don’t experience cross-plugin compatibility issues that can slow down or break your WordPress site when you migrate. All-in-One WP Migration has partnered with multiple theme and plugin vendors to distribute their products with us as a single, easy-to-install migration and backup package. These vendors trust our migration plugin to provide their customers with reliable product delivery, support, migrations, and backups. Cloud Storage Supported: All-in-One WP Migration supports backup and migration to all major cloud storage services. The plugin comes preinstalled on all Bitnami WordPress sites running on AWS, Google Compute Cloud, and Microsoft Azure – ready to migrate and backup out of the box. Case Studies: Small Business Migration: A small online retailer used All-in-One WP Migration to migrate to a more robust hosting solution, creating a full backup before the migration and completing the move without downtime during peak shopping season. Educational Migration: A prominent university utilized All-in-One WP Migration to migrate and consolidate multiple departmental sites into a single WordPress network, with automated backups ensuring no data was lost during migration. Government Migration: Following a directive to improve digital accessibility, a government agency used our migration plugin to migrate their content to a new, compliant platform without impacting public access to critical information. Contact us Report a security vulnerability Get free help from us here Report a bug or request a feature Find out more about us Privacy Policy All-in-One WP Migration is designed to fully respect and protect the personal information of its users. It asks for your consent to collect the user’s email address when filling the plugin’s contact form. All-in-One WP Migration is in full compliance with General Data Protection Regulation (GDPR). See our GDPR Compliant Privacy Policy here.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C