EUVD-2026-81490
GHSA-4xw8-32jx-mj44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Migratico Lite ≤2.6.8
-
DeliverySend crafted request to injection endpoint
-
ExploitAttacker input reaches PHP code sink
-
ExecutionExecute arbitrary code as web user
-
ImpactDeploy webshell / full site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions in the vendor model - remote unauthenticated code execution against a WordPress site with the Migratico Lite plugin (<=2.6.8) installed and active, per CVSS AV:N/AC:L/PR:N/UI:N. LIMITING FACTORS: exploitation requires the target to actually run this specific plugin (a niche migration plugin with a modest install base), and the sparse advisory does not disclose the exact vulnerable endpoint/parameter, so weaponization currently depends on an attacker independently locating the injection sink. No authentication, user interaction, or non-default configuration is required according to the provided vector. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a worst-case scenario: unauthenticated, network-reachable code injection (CWE-94) requiring no user interaction and yielding full confidentiality, integrity and availability impact. If accurate, this is a genuine top-priority issue - unauthenticated RCE in a WordPress plugin is exactly the class of bug that gets mass-scanned and weaponized once details surface. However, the signal set is thin and partly missing: there is NO EPSS score, NO CISA KEV listing, NO SSVC decision data, and NO public POC referenced - the only source is a single Patchstack advisory. The near-empty description ('Unauthenticated Remote Code Execution in Migratico Lite <= 2.6.8') provides no technical detail on the injection sink or entry point, so the 10.0 and the S:C (scope change) cannot be independently corroborated. Bottom line: treat as HIGH/urgent to patch given the vulnerability class and unauthenticated vector, but note the raw 10.0 is vendor-assigned on a sparse description and no active-exploitation or POC evidence exists yet - real-world risk is currently bounded by the plugin's modest deployment footprint rather than by demonstrated in-the-wild abuse. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running Migratico Lite <= 2.6.8, reaching an endpoint that passes attacker-controlled input into a code-execution/evaluation sink (CWE-94), and executes arbitrary PHP on the server. No public exploit code is identified at time of analysis, but because the CVSS vector is AV:N/AC:L/PR:N/UI:N the attack is trivially automatable once the vulnerable parameter is known. Successful exploitation leads to full site compromise (webshell, data theft, defacement, pivot). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unauthenticated remote code execution in Migratico Lite, a WordPress site-migration plugin, affects all versions up to and including 2.6.8 and lets a remote attacker who can reach an affected site inject and execute arbitrary code with the privileges of the web server. The vendor-disclosed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0, reported by Patchstack) requires no authentication and no user interaction, so any WordPress installation running an affected plugin version is potentially exposed; our independent assessment keeps the same network/authentication profile but scores scope as unchanged (S:U), giving an effective base score of 9.8. Exploitation is tempered by practical limits: Migratico Lite is a niche migration plugin with a modest install base, and the sparse public advisory does not disclose the vulnerable endpoint or parameter, so no public exploit code has been identified at time of analysis and weaponization currently depends on an attacker locating the injection sink themselves. There is no CISA KEV entry for this CVE.
RemediationAI
No vendor-released patch was identified at time of analysis for CVE-2026-62104 - the only available reference (the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/migratico-lite/vulnerability/wordpress-migratico-lite-plugin-2-6-8-remote-code-execution-rce-vulnerability?_s_id=cve) does not name a fixed version, so administrators should check the WordPress plugin repository and the vendor's channel for a release above 2.6.8 and upgrade immediately once one appears. Because the vulnerable surface is a plugin and the disclosure is sparse, the most reliable near-term control is to deactivate and delete Migratico Lite if migration functionality is not actively needed - the trade-off is loss of the migration feature, but it fully removes the exposed code path. If the plugin must stay active, restrict access to the plugin's directory and any associated AJAX/REST endpoints (for example, deny direct HTTP access to /wp-content/plugins/migratico-lite/ via web-server rules and block unauthenticated requests to admin-ajax.php actions registered by the plugin) - this can break legitimate plugin workflows and will not stop an attacker who reaches the sink through a public entry point. Add virtual patching at a WAF or reverse proxy targeting code-injection payload patterns reaching the plugin, understanding that generic signatures are bypassable and offer only a stopgap. Finally, treat any site that ran Migratico Lite <=2.6.8 while exposed as potentially compromised: review web-server and PHP logs for anomalous requests to plugin paths, audit WordPress users and scheduled tasks, verify core/plugin file integrity, and rotate database credentials and WordPress salts found in wp-config.php. Note that per the CC0/authoritative CVSS vector, no authentication or user interaction is required, so IP allow-listing of administrative interfaces alone does not mitigate the risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-94 (Improper Control of Generation of Code, i.e. code injection), the same family that covers PHP patterns such as eval(), create_function(), assert() with string arguments, dynamic include/require paths, and template or serialized-payload handling that eventually reaches an interpreter. In a WordPress context this typically manifests when a plugin passes request-controlled data (query string, POST body, cookie, or REST/AJAX parameter) into code-generation logic without sanitization or an allow-list, allowing an attacker to supply PHP that runs in the web server's process. The CPE cpe:2.3:a:superweby:migratico_lite:*:*:*:*:*:*:*:* confirms the affected artifact is the Superweby-published Migratico Lite WordPress plugin across all tracked versions (advisory scope: <=2.6.8), and the EUVD record EUVD-2026-81490 mirrors that version range. Because the vulnerability is in a plugin rather than WordPress core, the exposed attack surface is limited to sites where the plugin is installed and active; however, because plugin endpoints are commonly reachable without authentication, the CVSS:3.1/AV:N/AC:L/PR:N/UI:N profile is plausible, and the full C/I/A:H impact reflects that code execution under the web server user normally permits reading wp-config.php, database access, persistent backdoors, and site defacement or exfiltration. Note the scope discrepancy: Patchstack's 10.0 rating assumes S:C (scope change), while our independent assessment treats the impact as contained within the vulnerable component (S:U), producing a 9.8 rather than 10.0 - the difference reflects scoring assumptions, not a lower severity of the underlying code-injection flaw.
Know when Migratico Lite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network code injection yielding full RCE justifies AV:N/AC:L/PR:N/UI:N and C/I/A:H; I use S:U as the description gives no evidence code escapes the WordPress/PHP security scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.
Executive ViewAI
Migratico Lite, a WordPress site-migration plugin (all versions up to and including 2.6.8), contains an unauthenticated remote code execution vulnerability (CVE-2026-62104, CVSS 10.0) that allows any remote attacker to execute arbitrary code with web server privileges. Although the plugin has a modest install base and no public exploit identified at time of analysis, any organization hosting affected WordPress sites faces potential full server compromise, data theft, and lateral movement. Leadership should care because no vendor patch exists, and exploitation requires only network access to the site, making immediate inventory and mitigation critical.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing the Migratico Lite plugin, deploying web application firewall (WAF) rules to block access to all plugin endpoints, restricting network access to WordPress administrative interfaces, and monitoring logs for exploitation attempts. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB