CVE-2024-9162 is a code injection vulnerability (CWE-94) in the All-in-One WP Migration and Backup plugin for WordPress, affecting all versions up to and including 7.86. The flaw arises from missing file type validation during the export process, enabling authenticated users with administrator privileges to create export files with a .php extension containing arbitrary PHP code. This can result in remote code execution on the web server hosting the plugin. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. No vendor advisory or patch information is currently available, and the plugin is not a cloud service.

An attacker with administrator-level access can leverage this vulnerability to inject arbitrary PHP code into export files on the server, potentially leading to remote code execution. This compromises confidentiality, integrity, and availability of the affected system. Since exploitation requires high privileges, the risk is limited to scenarios where an attacker already has administrative access to the WordPress site. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to export file creation. Avoid using export functionality in untrusted environments. Do not expose the WordPress admin interface to untrusted networks.