CVE-2024-13609
MEDIUM EXPLOITED NUCLEI1 Click WordPress Migration Plugin < 2.2 - Unauthenticated Sensitive Information Exposure via class-ocm-backup.php
Title source: llmExploitation Summary
CVE-2024-13609 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.
Description
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.
Nuclei Templates (1)
WordPress 1 Click Migration Plugin < 2.3 - Information Exposure
MEDIUMVERIFIEDby pussycat0x
FOFA:
body="/wp-content/plugins/1-click-migration/"
References (3)
Core 3
Scores
CVSS v3
5.9
EPSS
0.0158
EPSS Percentile
72.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
VulnCheck KEV
2026-03-31
CWE
CWE-200
Status
published
Products (2)
1clickmigration/1 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone
< 2.2
1clickmigration/1_click_migration
< 2.1
Published
Feb 18, 2025
Tracked Since
Feb 18, 2026