Unauthorized Data Modification in 1 Click WordPress Migration Plugin by WordPress

CVE-2025-3455

What is CVE-2025-3455?

The 1 Click WordPress Migration Plugin, a popular tool for seamless WordPress migrations, has a vulnerability that allows authenticated attackers to manipulate data. This is due to a missing capability check in the 'start_restore' function, present in all versions up to and including 2.2. Attackers with Subscriber-level access or higher could exploit this issue to upload arbitrary files to the server hosting the affected WordPress site. This vulnerability poses a significant risk, as it paves the way for potential remote code execution, highlighting the urgent need for site administrators to update the plugin and implement necessary security measures.

References