CVE-2024-13609

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13609
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/1-click-migration/trunk/inc/backup/class-ocm-backup.php Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/d33199ea-7c96-4c60-a7b8-5c7e9835e231?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:1clickmigration:1_click_migration:*:*:*:*:*:wordpress:*:*
History

21 Feb 2025, 16:06

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/1-click-migration/trunk/inc/backup/class-ocm-backup.php - () https://plugins.trac.wordpress.org/browser/1-click-migration/trunk/inc/backup/class-ocm-backup.php - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/d33199ea-7c96-4c60-a7b8-5c7e9835e231?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/d33199ea-7c96-4c60-a7b8-5c7e9835e231?source=cve - Third Party Advisory
CPE cpe:2.3:a:1clickmigration:1_click_migration:*:*:*:*:*:wordpress:*:*
CWE NVD-CWE-noinfo
First Time 1clickmigration
1clickmigration 1 Click Migration
Summary
  • (es) El complemento 1 Click WordPress Migration Plugin – 100% FREE for a limited time para WordPress es vulnerable a la exposición de información confidencial en todas las versiones hasta la 2.1 incluida a través de class-ocm-backup.php. Esto permite que atacantes no autenticados extraigan datos confidenciales, incluidos nombres de usuario y sus respectivos hashes de contraseñas, durante un breve período de tiempo en el que se realiza la copia de seguridad.

18 Feb 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-18 05:15

Updated : 2025-02-21 16:06

NVD link : CVE-2024-13609

Mitre link : CVE-2024-13609

CVE.ORG link : CVE-2024-13609

JSON object : View

Products Affected

1clickmigration

  • 1_click_migration
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo