CVE

CVE-2024-13609

5.9

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

1 click migration & backup: free wordpress migration plugin with zero downtime & easy clone

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumMisconfiguration~10 seconds

WordPress 1 Click Migration Plugin < 2.3 - Information Exposure

The 1 Click WordPress Migration Plugin - 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process. References: https://wpscan.com/vulnerability/17fa121a-caa6-46ef-a865-eafd97d86abb/ https://nvd.nist.gov/vuln/detail/CVE-2024-13609 Remediation: Update to the latest version of the plugin where the issue is fixed.

url

Scanner page →Run scanner

CVE history: 1 click migration & backup: free wordpress migration plugin with zero downtime & easy clone

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →