Description
WordPress Plugin All-in-One WP Migration is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently guess and download backup files. WordPress Plugin All-in-One WP Migration version 7.14 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 7.15 or latest
References
https://vavkamil.cz/2020/03/25/all-in-one-wp-migration/
https://plugins.svn.wordpress.org/all-in-one-wp-migration/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Special Text Boxes Arbitrary File Upload (5.1.90)
WordPress 3.7.3 Multiple Vulnerabilities (3.7 - 3.7.3)
WordPress Plugin File Manager Unspecified Vulnerability (2.2.0)
WordPress Plugin Profile Extra Fields by BestWebSoft Cross-Site Scripting (1.0.7)
WordPress 4.9.x Cross-Domain Flash Injection Vulnerability (4.9 - 4.9.1)