CVE-2026-12898 is a CWE-22 path traversal vulnerability in the All-in-One WP Migration and Backup WordPress plugin. Versions prior to 7.106 do not properly sanitize user input when building file paths, enabling unauthenticated attackers to write log files arbitrarily outside the designated storage directory. This improper limitation of pathname can lead to unauthorized file creation or modification.

An attacker can exploit this vulnerability to create or append log files in arbitrary locations on the server outside the intended directory. This may lead to unauthorized file manipulation, potential information disclosure, or other impacts depending on the server environment and file system permissions. No known exploits in the wild have been reported.

No official patch or remediation level has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin and monitor for suspicious activity related to file creation. Avoid exposing the plugin to untrusted users.