CVE-2024-8852: 
WordPress vulnerability analysis and mitigation

The All-in-One WP Migration and Backup plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-8852) affecting all versions up to and including 7.86. The vulnerability was discovered and reported by Wordfence, with a CVSS v3.1 base score of 5.3 (Medium) (NVD, Wordfence Advisory).

The vulnerability stems from publicly exposed log files that contain sensitive information. The issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability has a CVSS v3.1 vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it can be exploited remotely with low attack complexity and requires no privileges or user interaction (NVD).

The vulnerability allows unauthenticated attackers to view potentially sensitive information such as full system paths contained in the exposed log files. This information disclosure could potentially be used to facilitate other attacks (NVD).

Users should upgrade to version 7.87 or later which contains fixes for this vulnerability. The fix can be found in the WordPress plugin repository (WordPress Plugin).