The 1 Click Migration & Backup WordPress plugin (versions up to 2.2) is vulnerable to CSRF due to improper nonce validation in the cancel_actions() function. This flaw allows unauthenticated attackers to cause an administrator to cancel an ongoing backup by tricking them into clicking a malicious link or performing a similar action. The vulnerability impacts the integrity of backup operations but does not affect confidentiality or availability directly. No known exploits are reported in the wild, and no official patch or vendor advisory is currently available.

An attacker can cause an administrator to cancel a backup operation without their intent, potentially disrupting backup processes. This impacts the integrity of backup management but does not disclose sensitive data or cause denial of service. The attack requires user interaction (administrator clicking a crafted link). There is no indication of broader system compromise or data leakage from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for plugin updates from the vendor is recommended to apply any official fixes once released.