1-Click WordPress Migration Plugin – Backup, Migrate & Clone
1-Click WordPress Migration Plugin – Backup, Migrate & Clone has 4 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 4 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 4 disclosures.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), Unrestricted Upload Of File With Dangerous Type.
Every one of the 4 issues recorded for 1-Click WordPress Migration Plugin – Backup, Migrate & Clone has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, most of them (2) reported by Joshua Provoste. 1-Click WordPress Migration Plugin – Backup, Migrate & Clone is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-34551 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Read the full analysisVulnerability Records

1-Click WordPress Migration Plugin – Backup, Migrate & Clone
Author
1clickmigration
Back up, migrate and clone a WordPress site 1-Click Migration backs up your WordPress website and emails you an 8-character restore code. Paste that code into a new host, a new domain or a second install, and the site is restored there. Site addresses are updated throughout the database, serialized data included. Your live site stays online while the backup runs. It’s free, with no account or license key. What you can do with it Move to a new host. Transfer a website between any two hosts without downloading or uploading backup files yourself. Change your domain name. Copy a WordPress site to a new domain, and the old address is replaced everywhere in the database, including inside serialized options and widgets. Hand a site over to a client. Move WordPress to the client’s own hosting account. The site transfer takes one backup and one restore. Go from localhost or staging to live. Push staging to live, or move WordPress from localhost to a server. Back up the staging or local site and restore it on the live server. Clone or duplicate a site. Duplicate a WordPress site for staging or testing by restoring its backup on a second install. Move large sites. There is no 4GB zip cap. Back up and restore the database, plugins, themes and uploads together, or one part at a time. Use it for any WordPress site migration: a hosting migration to a new provider, a server migration within the same host, a domain migration, or a move from localhost to live. You can move WordPress to another server, host or domain, and the migration itself needs no FTP, cPanel or phpMyAdmin, just a WordPress login on each site. It’s a free, automatic migration tool for a complete website migration, from the database to the uploads folder. Built to fail safely The database is imported into temporary tables and checked before it replaces anything. If a check fails, the restore stops, says why, and leaves your site as it was. Before the restore starts, the plugin checks your code and lists other domains found in the backup, such as an old domain or a CDN, so you choose which ones to rewrite. Free disk space is checked before files are unpacked. Long backups and restores run in short steps and pick up where they left off, so hosts with strict PHP time limits are fine. Private by default Every part of the backup is AES-256 encrypted on your server before it’s uploaded. Backups are stored on Amazon S3 and deleted after 48 hours. Only someone with the restore code can restore the backup, and we email the code only to the address you enter. Learn more at 1clickmigration.com. How it works On the site you’re moving from Remove themes, plugins and media you don’t need. A smaller site backs up faster. Deactivate every plugin except 1-Click Migration. Go to Tools → One Click Migration, enter your email and click Start backup. Most backups finish in 10–30 minutes. Keep the email with your 8-character restore code. It’s the only way to restore the backup. On the site you’re moving to Install WordPress and 1-Click Migration on the new host or domain. Delete any other plugins the host pre-installed. Paste the restore code, click Check backup & restore, review any extra site addresses, then start the restore. Log in with the usernames and passwords from the original site. If a large site fails to back up or restore in one go, click Stop & Reset and use Advanced options to move one part at a time, with the database last. Each partial backup gets its own restore code. Reviews If 1-Click Migration moved your site, please leave a review. It helps other people find the plugin and helps us improve it.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C