CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.
Explanation of Vulnerability in Simple Terms
The 1 Click Migration & Backup plugin for WordPress versions 2.2 and earlier exposes sensitive information that attackers can access over the network without authentication. The vulnerability requires specific conditions to exploit but can reveal confidential data. Site administrators should update to a version newer than 2.2 as soon as a patch becomes available.
What an attacker can do
Access sensitive information from the plugin without logging in.
Potential impact on your site
Confidential data may be exposed to unauthenticated attackers, potentially including migration or backup details.
Conditions required to exploit
Network access to the WordPress site; specific conditions must be met to trigger the exposure.
Key dates
External resources
Related vulnerabilities
