Connect with us

Hi, what are you looking for?



Vulnerability in WordPress Migration Plugin Exposes Websites to Attacks

A vulnerability in the All-in-One WP Migration plugin’s extensions exposes WordPress websites to attacks leading to sensitive information disclosure.

A vulnerability in several extensions for the All-in-One WP Migration plugin potentially exposes WordPress websites to attacks leading to sensitive information disclosure.

With more than five million installations and maintained by ServMask, All-in-One WP Migration is a highly popular plugin for moving websites that also provides several premium extensions for migrating to third-party platforms.

On Wednesday, WordPress security firm Patchstack shared details on a vulnerability impacting All-in-One WP Migration’s Box, Google Drive, OneDrive, and Dropbox extensions that could allow attackers to access sensitive information.

Tracked as CVE-2023-40004 and described as an unauthenticated access token manipulation issue, the bug could allow an unauthenticated attacker to tamper with the access token configuration of the affected extension.

“This access token manipulation could result in a potential sensitive information disclosure of migration to the attacker’s controlled third-party account or restore a malicious backup,” Patchstack says.

The flaw was identified in the init function of the affected extensions, which is “hooked to the WordPress’s admin_init hook”, which in turn can be triggered by an attacker, without authentication.

“Since there is no permission and nonce validation on the init function, an unauthenticated user is able to modify or delete the access token used on each of the affected extensions,” Patchstack explains.

On July 18, the WordPress security firm reported the vulnerability to ServMask, which patched the bug in all impacted extensions by “adding permission and nonce validation on the init function”.

Advertisement. Scroll to continue reading.

Users are advised to update to All-in-One WP Migration’s Box extension version 1.54, Google Drive extension version 2.80, OneDrive extension version 1.67, and Dropbox extension version 3.76, which were released at the end of July.

Related: Critical WordPress Plugin Vulnerabilities Impact Thousands of Sites

Related: WordPress Sites Hacked via Critical Vulnerability in WooCommerce Payments Plugin

Related: Popular WordPress Security Plugin Caught Logging Plaintext Passwords

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.


Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.


People on the Move

Check Point Software has appointed Nadav Zafrir as Chief Executive Officer.

BlackFog has named Brenda Robb as President, John Sarantakes as CRO, and Mark Griffith as VP of Strategic Sales.

Former NSA cybersecurity chief Rob Joyce has joined Sandfly Security's Advisory Board.

More People On The Move

Expert Insights