Unauthorized Data Modification in 1 Click WordPress Migration Plugin by WordPress

CVE-2025-3455

What is CVE-2025-3455?

The 1 Click WordPress Migration Plugin, a popular tool for seamless WordPress migrations, has a vulnerability that allows authenticated attackers to manipulate data. This is due to a missing capability check in the 'start_restore' function, present in all versions up to and including 2.2. Attackers with Subscriber-level access or higher could exploit this issue to upload arbitrary files to the server hosting the affected WordPress site. This vulnerability poses a significant risk, as it paves the way for potential remote code execution, highlighting the urgent need for site administrators to update the plugin and implement necessary security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References