All-in-One WP Migration and Backup

The All-in-One WP Migration plugin incorrectly applies stripslashes_deep() to the $_FILES superglobal. This function is designed for string data like $_POST or $_GET, not for file upload metadata. Applying it to $_FILES can corrupt file paths or names, potentially leading to path traversal or unexpected file handling behavior.

This vulnerability affects the following application versions:

• All-in-One WP Migration and Backup 7.98

This security patch hardens your database migration tools by replacing PHP’s error-prone unserialize() with a safe, in-house parser that prevents tampering and malformed payloads.

This vulnerability affects the following application versions:

• All-in-One WP Migration and Backup 7.76
• All-in-One WP Migration and Backup 7.77
• All-in-One WP Migration and Backup 7.78
• All-in-One WP Migration and Backup 7.79
• All-in-One WP Migration and Backup 7.80
• All-in-One WP Migration and Backup 7.81
• All-in-One WP Migration and Backup 7.82
• All-in-One WP Migration and Backup 7.83
• All-in-One WP Migration and Backup 7.84
• All-in-One WP Migration and Backup 7.85
• All-in-One WP Migration and Backup 7.86
• All-in-One WP Migration and Backup 7.87
• All-in-One WP Migration and Backup 7.88
• All-in-One WP Migration and Backup 7.89