CVE-2025-3455: WordPress Migration Plugin RCE Vulnerability

CVE-2025-3455 Overview

CVE-2025-3455 affects the 1 Click WordPress Migration Plugin, a backup and migration tool distributed through the WordPress plugin directory. The vulnerability stems from a missing capability check on the start_restore function in all versions up to and including 2.2. Authenticated users with Subscriber-level access or higher can upload arbitrary files to the affected site's server. Successful exploitation can lead to remote code execution on the underlying web host. The flaw is categorized as Unrestricted Upload of File with Dangerous Type [CWE-434].

Critical Impact
Authenticated Subscriber accounts can upload arbitrary files through the start_restore function, enabling remote code execution and full site compromise.

Affected Products

1 Click WordPress Migration Plugin – 100% FREE for a limited time
All versions up to and including 2.2
WordPress sites with the plugin installed and active

Discovery Timeline

2025-05-09 - CVE-2025-3455 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3455

Vulnerability Analysis

The 1 Click WordPress Migration Plugin exposes a restore routine intended to import backup archives during site migrations. The start_restore function in inc/backup/class-ocm-backup.php accepts uploaded archive data and writes files to the WordPress filesystem. The handler does not verify the caller's WordPress capability before processing the upload. Any authenticated session, including a low-privilege Subscriber, can invoke the endpoint and stage attacker-controlled files inside the web root.

Because the plugin treats the upload as a trusted restore operation, files such as PHP scripts can be written to locations served by the web server. Once placed, the attacker requests the file directly and triggers code execution under the web server account. This converts a low-privilege WordPress account into full server-side code execution on the host.

Root Cause

The root cause is a missing authorization check [CWE-434, CWE-862]. The start_restore action handler lacks both a current_user_can() capability check and validation of the uploaded file type. WordPress treats Subscriber as a registration-level role, so any site permitting open registration effectively exposes the endpoint to unauthenticated attackers who can self-provision an account.

Attack Vector

Exploitation occurs over the network against the WordPress AJAX or admin endpoint that dispatches the restore action. The attacker authenticates as any user with Subscriber privileges or higher, then issues a crafted request to the start_restore handler containing a malicious archive or file payload. The plugin processes the input without privilege validation and persists the file to disk. The attacker then requests the dropped file through the web server to execute arbitrary PHP code.

For technical references, see the WordPress 1-Click Backup Code, the WordPress Changeset #3372639, and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-3455

Indicators of Compromise

Unexpected PHP files appearing in plugin, upload, or backup directories such as wp-content/uploads/ and wp-content/plugins/1-click-migration/.
HTTP POST requests from Subscriber accounts to admin-ajax.php referencing the start_restore action.
New or modified WordPress administrator accounts created shortly after suspicious upload activity.
Outbound network connections initiated by the PHP-FPM or web server process to unknown hosts.

Detection Strategies

Inspect web server access logs for POST requests to WordPress admin endpoints invoking restore-related actions from non-administrator session cookies.
Hash and baseline plugin directory contents, then alert on any new .php files written outside of expected update windows.
Correlate WordPress audit logs of Subscriber logins with subsequent file creation events on disk.

Monitoring Recommendations

Enable WordPress activity logging that records role, user ID, and AJAX action name for every privileged request.
Forward web server and PHP error logs to a centralized SIEM for correlation with file integrity monitoring events.
Monitor for PHP execution originating from upload directories, which should never serve executable content.

How to Mitigate CVE-2025-3455

Immediate Actions Required

Update the 1 Click WordPress Migration Plugin to the version published in changeset 3372639 or later, which adds the missing capability check.
If a patched release is not yet available for your install, deactivate and remove the plugin until it can be updated.
Audit all WordPress user accounts and remove Subscriber accounts that were not legitimately registered.
Scan the webroot for unexpected PHP files and rotate any secrets stored in wp-config.php if compromise is suspected.

Patch Information

The vendor addressed the issue in the commit referenced by WordPress Changeset #3372639, which adds proper authorization checks to the restore handler in class-ocm-backup.php. Administrators should upgrade through the WordPress plugin dashboard or replace the plugin files with the patched version from the WordPress plugin repository.

Workarounds

Disable open user registration in WordPress general settings to limit the pool of potential attackers.
Apply a web application firewall rule that blocks requests to admin-ajax.php containing the start_restore action from non-administrator users.
Restrict execution of PHP files in wp-content/uploads/ through web server configuration to contain post-upload exploitation.

bash

# Nginx configuration example to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}