CVE-2025-11427

MediumCVSS 5.8

Published: 18/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

42th percentile - higher than 42% of all known CVEs

Summary

The WP Migrate Lite plugin for WordPress in versions up to and including 2.7.6 is vulnerable to Blind Server-Side Request Forgery via the wpmdb_flush AJAX action. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application.

Risk Assessment

Attackers can use this vulnerability to probe and obtain information about internal services, potentially facilitating further attacks on internal infrastructure.

Recommendation

Update the WP Migrate Lite plugin to a version later than 2.7.6 or disable it if updating is not possible.

Other vulnerabilities in WP Migrate Lite

CVE-2026-49043Medium
There is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in WP Migrate Lite versions <= 2.7.8. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

Original NVD description (English source)

The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS