PT-2025-6565 · WordPress · 1 Click Wordpress Migration Plugin

Joshua Provoste · Published 2025-02-18 · Updated 2025-02-24 · CVE-2024-13555

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions 1 Click WordPress Migration Plugin – 100% FREE for a limited time versions up to 2.1

Description The issue is related to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the cancel actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Recommendations For versions up to 2.1, consider disabling the cancel actions() function until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid performing actions that could be triggered by a forged request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-13555

Affected Products

1 Click Wordpress Migration Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2024-13555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13555 · Security Note
• https://plugins.trac.wordpress.org/changeset/3372639/1-click-migration/trunk/inc/backup/class-ocm-backup.php · Note
• https://twitter.com/VulmonFeeds/status/1891780440232513588 · Twitter Post
• https://twitter.com/CVEnew/status/1891707981517013352 · Twitter Post
• https://t.me/cvenotify/111588 · Telegram Post
• https://wordpress.org/plugins/1-click-migration · Note
• https://t.me/cvenotify/112267 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/aee963fa-26b5-4bf0-b52f-095c67fb4834?source=cve · Note