CVE-2024-13555

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13555
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3372639/1-click-migration/trunk/inc/backup/class-ocm-backup.php
https://wordpress.org/plugins/1-click-migration/ Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/aee963fa-26b5-4bf0-b52f-095c67fb4834?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:1clickmigration:1_click_migration:*:*:*:*:*:wordpress:*:*
History

08 Apr 2026, 19:20

Type Values Removed Values Added
Summary (en) The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. (en) The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancel_actions() function. This makes it possible for unauthenticated attackers to cancel a triggered backup via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
  • () https://plugins.trac.wordpress.org/changeset/3372639/1-click-migration/trunk/inc/backup/class-ocm-backup.php -

24 Feb 2025, 14:54

Type Values Removed Values Added
CPE cpe:2.3:a:1clickmigration:1_click_migration:*:*:*:*:*:wordpress:*:*
References () https://wordpress.org/plugins/1-click-migration/ - () https://wordpress.org/plugins/1-click-migration/ - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/aee963fa-26b5-4bf0-b52f-095c67fb4834?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/aee963fa-26b5-4bf0-b52f-095c67fb4834?source=cve - Third Party Advisory
First Time 1clickmigration 1 Click Migration
1clickmigration
Summary
  • (es) El complemento 1 Click WordPress Migration Plugin – 100% FREE for a limited time para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta 2.1 incluida. Esto se debe a la validación de Nonce faltante o incorrecta en la función Tancel_actions (). Esto hace posible que los atacantes no autenticados cancelen una copia de seguridad activada a través de una solicitud falsificada otorgada que pueden engañar a un administrador del sitio para que realice una acción, como hacer clic en un enlace.

18 Feb 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-18 05:15

Updated : 2026-04-08 19:20

NVD link : CVE-2024-13555

Mitre link : CVE-2024-13555

CVE.ORG link : CVE-2024-13555

JSON object : View

Products Affected

1clickmigration

  • 1_click_migration
CWE
CWE-352

Cross-Site Request Forgery (CSRF)