CVE-2025-32257

MEDIUMNuclei

WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-32257 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migration: from n/a through <= 2.5.7.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 31, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 8, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

1 Click WordPress Migration

Browse 1clickmigration / 1 Click WordPress Migration1-click-migration

Default status: unaffected

CVE ListThrough 2.5.7affected

1_click_migration

Browse 1clickmigration / 1_click_migration
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUM1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure

1 Click WordPress Migration <= 2.2 contains an information disclosure caused by uncleared debug information, letting attackers retrieve embedded sensitive data, exploit requires no specific privileges.

Impact

Attackers can access sensitive embedded data, potentially leading to information disclosure and further exploitation.

Remediation

Remove debug information and update to the latest version of 1 Click WordPress Migration.

Authorspussycat0x
Template tagscvecve2025wpscanwordpresswp-plugin1clickmigrationvkev
FOFA: body="/wp-content/plugins/1-click-migration/"
https://wpscan.com/vulnerability/03211216-8cc9-49f9-83da-9fbc57554816/

Source: ProjectDiscovery

References

3