CVE-2025-11427mediumexplotación observadaCWE-918

CVE-2025-11427: fallo de gravedad media en wpengine WP Migrate Lite – Migration Made Easy

WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WP Migrate Lite – Migration Made Easy

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

35Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Attendcvss 5.8epss 0.5%
de la publicación al arma
Publicada en NVD18 nov
VulnCheck+329d
The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Productos afectados
wpengine · WP Migrate Lite – Migration Made Easy