The 1 Click Migration & Backup WordPress plugin suffers from a Sensitive Information Exposure vulnerability (CWE-200) in all versions up to 2.2. The issue exists in the class-ocm-backup.php file, where unauthenticated attackers can extract sensitive data such as usernames and password hashes during the backup process. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality. No official patch or vendor advisory is currently available, and no known exploits have been reported.

An attacker without authentication can obtain sensitive user information including usernames and password hashes during the backup operation. This exposure could lead to further compromise if the password hashes are cracked. The vulnerability does not affect integrity or availability directly but compromises confidentiality of user credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the plugin during backup operations or restricting access to backup-related endpoints to trusted users only. Monitor for updates from the vendor and apply any official patches promptly once released.