PT-2025-47295 · WordPress · Wp Migrate Lite – Wordpress Migration Made Easy

Dmitry Ignatyev · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-11427

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Migrate Lite – WordPress Migration Made Easy plugin versions prior to 2.7.7

Description The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is susceptible to a Blind Server-Side Request Forgery. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application. Exploitation of this issue could allow attackers to obtain information about internal services via the wpmdb flush API endpoint.

Recommendations Update the WP Migrate Lite – WordPress Migration Made Easy plugin to version 2.7.7 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-11427

Affected Products

Wp Migrate Lite – Wordpress Migration Made Easy

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11427 · Security Note
• https://t.me/cveNotify/143182 · Telegram Post
• https://twitter.com/CVEnew/status/1990740619883356167 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/Migration/Flush.php#L69 · Note
• https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/MigrationPersistence/Persistence.php#L50 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4b098711-ed01-4a71-b0df-30ff4fffa930?source=cve · Note
• https://research.cleantalk.org/cve-2025-11427 · Note