EUVD-2026-89854
GHSA-cm9v-88j7-m273
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Hostinger Migrator ≤1.0
-
DeliveryRequest unprotected migration endpoint
-
ExploitBypass missing authorization check
-
ExecutionDownload exposed migration/backup data
-
ImpactExtract site secrets and database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the target WordPress site has the Hostinger Migrator plugin (version 1.0 or earlier) installed and active, exposing an endpoint that performs no authorization check (CWE-862). No authentication, no user interaction, and no special configuration are needed - remote unauthenticated exploitation works against default installations of the affected plugin. The primary limiting factor is deployment scope: the plugin is niche and migration plugins are often enabled only briefly during a site move, narrowing the realistic exposure window; sites that removed or deactivated the plugin after migrating are not exposed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) describes a straightforward unauthenticated, network-reachable, low-complexity confidentiality breach with no integrity or availability impact - consistent with CWE-862 (Missing Authorization) in a WordPress migration plugin, where an exposed endpoint likely allows anyone to access migration/backup artifacts. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no signal of active exploitation or automated weaponization at this time; risk is currently theoretical but plausible. The pairing of PR:N + AC:L with C:H is the main risk driver: migration plugins commonly bundle full-site backups (wp-config secrets, database dumps with password hashes), so an authorization gap can translate into complete data disclosure. Net assessment: a genuinely meaningful confidentiality issue for any site still running the plugin, but tempered by likely low deployment footprint and the fact that migration plugins are frequently installed only transiently. Treat as a real, patch-worthy issue rather than an emergency - no conflicting signals were found in the input, though the absence of EPSS/KEV/POC means exploitation likelihood is unquantified. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker discovers a WordPress site running Hostinger Migrator <= 1.0 and directly requests the plugin's migration/backup endpoint that lacks an authorization check. Because no privileges or user interaction are required (PR:N/UI:N), the attacker retrieves the migration archive or exposed data, potentially harvesting the site database and configuration secrets. No public exploit code was identified at time of analysis, but the low complexity makes independent discovery feasible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated Broken Access Control in the Hostinger Migrator WordPress plugin (version 1.0 and earlier) lets any remote attacker reach a plugin endpoint that performs no authorization check, exposing migration and backup artifacts such as database dumps, file archives and site configuration data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) the impact is a high-confidentiality breach with no integrity or availability effect, exploitable against default installations with no credentials, user interaction or special configuration. No public exploit identified at time of analysis, and no EPSS score or CISA KEV entry was supplied; the practical risk is bounded by the plugin's niche adoption and the fact that migration plugins are often left active only briefly during a site move, so sites that have deactivated or removed the plugin since migrating are not exposed.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version number appears in the supplied data, so do not assume an upgrade target exists. The most reliable action is to deactivate and delete the Hostinger Migrator plugin once the site move is complete, which eliminates the endpoint entirely; this is the recommended permanent remedy and has no functional side effect for a site that is no longer migrating. If a migration is actively in progress and the plugin must stay enabled, restrict the plugin's endpoints at the edge - block or challenge requests to the plugin's directory and any associated REST/route paths in the WAF or reverse proxy, and allow them only from the source IPs of the migration process - accepting that overly broad blocking rules will break the migration itself. In parallel, treat any migration packages, SQL dumps or archive files left in web-accessible directories as already compromised: move them outside the document root or delete them, and rotate the database credentials, salts and API keys that those packages typically contain, since the high-confidentiality impact of this CWE-862 exposure means the leaked material is most likely exactly that kind of secret-bearing content. Verify that no stale migration artifacts remain reachable by requesting the plugin's known endpoint paths from an unauthenticated client after removal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin, cpe:2.3:a:hostinger:hostinger_migrator:*:*:*:*:*:*:*:* (all versions at or below 1.0), whose purpose is to move a WordPress site between hosts by generating and transferring migration packages. Because CWE-862 (Missing Authorization) is the assigned weakness, the root cause is a handler - typically a REST API route, admin-ajax action or direct PHP entry point - that is registered without a capability check or nonce verification, so the plugin's own access-control layer never runs. The CVSS vector confirms the classic profile of this defect class: PR:N means the endpoint is reachable by an unauthenticated network client, AC:L means no race or complex precondition is needed, and the C/I/A split (high confidentiality, zero integrity and availability) indicates the endpoint is a read/exfiltration surface rather than a write or destructive one, most plausibly serving migration archives, SQL dumps or stored credentials. The disclosure originates from Patchstack's WordPress plugin vulnerability database, which specialises in this pattern of unauthenticated endpoint exposure in the WordPress ecosystem.
Know when Hostinger Migrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated (PR:N) network-reachable (AV:N) missing-authorization flaw exploitable with low complexity (AC:L); confidentiality-only impact (C:H) as backup/migration data is disclosed with no integrity or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
Executive ViewAI
The Hostinger Migrator WordPress plugin (versions 1.0 and earlier) can expose database dumps, file archives, and site configuration data to unauthenticated remote access. Organizations that still have this plugin active-especially after a recent migration-face a high-confidentiality breach that may leak credentials and enable downstream compromise, though no public exploit identified at time of analysis and the plugin is niche. Leadership should prioritize removal or isolation because No vendor-released patch identified at time of analysis and the exposure requires no credentials or user interaction.
Deactivate and remove Hostinger Migrator version 1.0 and earlier; if removal is not immediately possible, block the vulnerable plugin endpoint at the WAF or restrict it by IP allowlist, take the site offline during migration, and rotate database credentials, WordPress salts, API keys, and any secrets that may have been exposed. Monitor vendor and CVE-2026-95587 advisories for a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB