The 1 Click Migration & Backup WordPress plugin suffers from an unrestricted file upload vulnerability (CWE-434) caused by the absence of a capability check in the 'start_restore' function. Authenticated attackers with low privileges (Subscriber-level) can exploit this flaw to upload arbitrary files to the server, potentially enabling remote code execution. This affects all versions up to and including 2.2. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access can upload arbitrary files to the server hosting the WordPress site via the vulnerable plugin, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.8) reflects the critical nature of this vulnerability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities if possible and monitor for suspicious file uploads related to the plugin. Avoid granting unnecessary privileges to low-level users. Follow vendor communications closely for updates on patches or official mitigations.