All-in-One WP Migration and Backup - Information Disclosure (CVE-2024-8852)
Description
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full paths contained in the exposed log files.
psychologyCrowdSec Analysis
CVE-2024-8852 is a vulnerability in the All-in-One WP Migration and Backup plugin for WordPress that exposes sensitive information through publicly accessible log files. Unauthenticated attackers can exploit this flaw to view details such as full file paths, potentially aiding in further attacks or reconnaissance against affected WordPress sites.
CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-8852 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by directly requesting the /wp-content/plugins/all-in-one-wp-migration/storage/error.log file, exposing sensitive information from the All-in-One WP Migration plugin on vulnerable WordPress sites.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-10-22 |
| Rule Released | 2025-11-26 |
| CrowdSec First Seen | 2025-11-28 |