WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.
Summary
The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11427
- 2026-10-03 Alias added: GHSA-8hv6-f9fq-qp39
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b098711-ed01-4a71-b0df-30ff4fffa930?source=cve
- https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/MigrationPersistence/Persistence.php#L50
- https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/Migration/Flush.php#L69
- https://research.cleantalk.org/cve-2025-11427/
More wpengine vulnerabilities
- TI-2023-06336 Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
- TI-2024-23053 Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.9
- TI-2019-07258 The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user… CVSS 3.0CRITICAL 9.8
- TI-2019-07259 An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. CVSS 3.0CRITICAL 9.1
- TI-2024-03640 Genesis Blocks <= 3.1.3 - Contributor+ Stored XSS CVSS 3.1MEDIUM 6.8
- TI-2022-01434 WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-11427 · CVE Program
- CVE-2025-11427 · NVD
- FIRST EPSS
- GHSA-8hv6-f9fq-qp39 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences