# CVE-2024-8852: All-in-One WP Migration and Backup - Information Disclosure

> Live exploitation tracking for CVE-2024-8852 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-8852

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Yaniiliev All-in-One WP Migration and Backup
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** wordpress

## Description

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full paths contained in the exposed log files.

## CrowdSec analysis

[CVE-2024-8852](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-8852) is a vulnerability in the All-in-One WP Migration and Backup plugin for WordPress that exposes sensitive information through publicly accessible log files. Unauthenticated attackers can exploit this flaw to view details such as full file paths, potentially aiding in further attacks or reconnaissance against affected WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-8852 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by directly requesting the `/wp-content/plugins/all-in-one-wp-migration/storage/error.log` file, exposing sensitive information from the All-in-One WP Migration plugin on vulnerable WordPress sites.

## Timeline

- 2024-10-22: CVE Published. CVE-2024-8852 is published to NVD.
- 2025-11-26: Rule Released. CrowdSec releases a rule to detect CVE-2024-8852 exploitation attempts against the CrowdSec Network.
- 2025-11-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-8852 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8852.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-8852) follows observed exploitation activity for CVE-2024-8852. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.