EUVD-2026-70572
GHSA-28x5-jxp2-gpfp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network endpoint triggers unbounded resource use; only availability is impacted and scope is unchanged, consistent with the provided vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Denial of Service Attack in Migrate Guru - Site Migration & Cloning <= 6.65 versions.
AnalysisAI
Uncontrolled resource consumption in the Migrate Guru - Site Migration & Cloning WordPress plugin (versions 6.65 and earlier) exposes any WordPress installation running the plugin to remote denial of service by unauthenticated network attackers. The root cause (CWE-770) indicates that one or more plugin endpoints perform resource-intensive operations without adequate rate limiting or throttling, allowing an attacker to exhaust server capacity without supplying credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Migrate Guru plugin must be installed and activated on the target WordPress site - a deactivated or absent plugin registers no endpoints and is entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (High) reflects a network-accessible, zero-authentication attack path with no complexity barriers - even a mid-sized municipal IT team in koszalin operating shared WordPress hosting should treat the exposure of this endpoint as a realistic operational threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Migrate Guru plugin to a version beyond 6.65; the exact patched release number is not stated in the available data and has not been independently confirmed - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/migrate-guru/vulnerability/wordpress-migrate-guru-site-migration-cloning-plugin-6-65-denial-of-service-attack-vulnerability and the official WordPress plugin repository changelog for the latest available release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
In the next 24 hours: identify all WordPress installations running Migrate Guru plugin versions 6.65 or earlier and document which are actively performing migrations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today