PT-2025-20485 · WordPress · 1 Click Wordpress Migration Plugin

Kate Kligman · Published 2025-05-09 · Updated 2025-05-09 · CVE-2025-3455

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The 1 Click WordPress Migration Plugin versions prior to 2.3

Description The issue is related to a missing capability check on the start restore function, allowing authenticated attackers with Subscriber-level access and above to upload arbitrary files on the affected site's server. This could potentially lead to remote code execution.

Recommendations For versions up to and including 2.2, update to version 2.3 or later to resolve the issue. As a temporary workaround, consider disabling the start restore function until a patch is available. Restrict access to file upload functionality to minimize the risk of exploitation.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-3455

Affected Products

1 Click Wordpress Migration Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3455 · Security Note
• https://plugins.trac.wordpress.org/changeset/3372639/1-click-migration/trunk/inc/backup/class-ocm-backup.php · Note
• https://t.me/cvedetector/24924 · Telegram Post
• https://plugins.trac.wordpress.org/browser/1-click-migration/trunk/inc/backup/class-ocm-backup.php#L403 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e982ae88-cfd0-46b9-ad64-00e398d307d6?source=cve · Note
• https://t.me/cvetracker/23466 · Telegram Post
• https://twitter.com/cybercronai/status/1920866500279197953 · Twitter Post
• https://twitter.com/CVEnew/status/1920739444677591379 · Twitter Post