What the vulnerability does
01Description
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
The 1 Click Migration & Backup plugin for WordPress versions 2.2 and earlier does not properly validate requests, allowing attackers to perform unwanted actions on behalf of site administrators without their knowledge. An attacker can craft a malicious link or page that, when visited by an admin, triggers administrative functions like creating backups or modifying settings. This vulnerability requires no authentication but does require an admin to visit a malicious page.
What an attacker can do
03Attacker Capabilities
Perform administrative actions (backups, settings changes) on the site without the admin's consent.
Potential impact on your site
04Site Impact
Attackers can trigger unwanted backups, modify plugin settings, or perform other admin functions via social engineering.
Conditions required to exploit
05Prerequisites
An administrator must visit a malicious page or click a crafted link while logged in.
Key dates
06Disclosure timeline
February 18, 2025
CVE published
April 8, 2026
Record updated
