CVE-2025-3455
published 2025-05-09CVE-2025-3455: The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.24%
65.5th percentile
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'start_restore' function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 1clickmigration | 1_click_migration_backup_free_wordpress_migration_plugin_with_zero_downtime_easy | <= 2.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/1-click-migration/trunk/inc/backup/class-ocm-backup.php#L403https://plugins.trac.wordpress.org/changeset/3372639/1-click-migration/trunk/inc/backup/class-ocm-backup.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/e982ae88-cfd0-46b9-ad64-00e398d307d6?source=cve
2025-05-09
Published