EUVD-2026-93070
GHSA-hwqw-r59q-mqmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Xserver Migrator ≤1.6.6
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionAccess exposed sensitive data endpoint
-
ImpactHarvest disclosed sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection System info exposure prevention
|
| Exploitation Conditions | Requires only that the target WordPress site has the Xserver Migrator plugin installed and active at version 1.6.6 or earlier; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special configuration is needed, so default installations of the vulnerable version are exploitable remotely. The description does not name the exact feature, endpoint, or data exposed, so the precise trigger is not specified in available data. The principal limiting factor is deployment scope: the plugin is a niche migration tool, so the vulnerable population is small, and sites already updated past 1.6.6 (if a fix exists) are out of scope. |
| Impact | The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5 HIGH) describes a cleanly remote, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability effect - internally consistent with CWE-497 (exposure of sensitive information) and the 'Unauthenticated Sensitive Data Exposure' description. However, the only non-CVSS exploitation signals are MISSING: no EPSS score, no CISA KEV listing, and no indication of public exploit code (POC) in the input. There is no SSVC decision data provided. So while the CVSS profile looks superficially serious (trivially reachable confidentiality breach), there is no evidence of active exploitation or weaponization. The dominant risk-reducing factor is product footprint: Xserver Migrator is a niche WordPress migration plugin tied to a specific (Japanese) hosting ecosystem, not a widely deployed component. Net assessment: a legitimately exploitable information-disclosure bug that warrants prompt patching on affected sites, but absent KEV/EPSS/POC signals it reads as a moderate, patch-in-normal-cycle issue rather than an emergency, and its real-world exposure is constrained by the plugin's limited deployment. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted web request to a WordPress site running Xserver Migrator 1.6.6 or earlier and retrieves sensitive data (e.g., configuration, migration, or environment information) that should not be publicly accessible. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are needed. No public exploit code was identified in the provided data, so exploitation would currently require an attacker to independently identify the vulnerable endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.
RemediationAI
No fixed release version is identified in the available intelligence, so treat the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/xserver-migrator/vulnerability/wordpress-xserver-migrator-plugin-1-6-6-sensitive-data-exposure-vulnerability?_s_id=cve as the authoritative source for a patched build and upgrade the plugin as soon as a version later than 1.6.6 is published; until then, the most effective control is to deactivate and remove Xserver Migrator from any site that is not actively performing a migration, since the plugin is not needed at rest and removal eliminates the exposed surface entirely. If removal is not operationally possible, restrict access to the plugin's directory and any migration or export endpoints at the web server or WAF layer (block direct requests to /wp-content/plugins/xserver-migrator/* and deny unauthenticated access to its admin-ajax or REST handlers) and require authentication in front of those paths; the trade-off is that blanket path blocking can break legitimate migration workflows and may not cover every dynamic request the plugin registers. Also review web logs for unauthenticated requests to the plugin directory as a detection measure, and rotate any credentials, salts, or database secrets that may have been exposed if suspicious access is observed. Because the CVSS vector is PR:N/UI:N with high confidentiality impact, these compensating controls should be applied immediately rather than waiting for the standard patch cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is a WordPress plugin, Xserver Migrator, distributed through the WordPress plugin ecosystem and catalogued under CPE cpe:2.3:a:xserver:xserver_migrator:*:*:*:*:*:*:*:* with all versions up to and including 1.6.6 flagged as vulnerable (ENISA EUVD-2026-93070 records the same '<= 1.6.6' boundary). The root cause class is CWE-497, exposure of sensitive system information to an unauthorized control sphere, which in a WordPress context typically means a plugin endpoint, handler, or generated artifact (for example a migration/export routine, status endpoint, or on-disk dump) is reachable without the capability checks or nonce/permission validation that the platform expects, letting the response leak configuration, credential, path, or database-related detail. Migration plugins are especially exposed to this class because they handle database dumps and connection strings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the trigger is a straightforward remote request with no authentication or interaction, and the single-scope, confidentiality-only scoring means the exposure is read-only: an attacker gains information, not code execution or data modification. The public reporting does not name the specific endpoint, parameter, or the exact data field exposed, so the precise request that triggers disclosure cannot be reconstructed from the available intelligence and would require source review of the 1.6.6 code base or the vendor/ Patchstack advisory.
Know when Xserver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote data disclosure (PR:N/AV:N/AC:L/UI:N) with confidentiality-only impact (C:H, I:N, A:N) and no scope change, matching CWE-497.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
Executive ViewAI
The Xserver Migrator WordPress plugin (versions up to and including 1.6.6) contains an unauthenticated sensitive data exposure vulnerability (CVE-2026-102387, CVSS 7.5) that could allow any remote attacker to read confidential information. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, but the high confidentiality impact and lack of authentication require immediate attention. Organizations using this plugin should prioritize identifying affected instances and applying interim mitigations to protect sensitive data.
Disable or remove the Xserver Migrator plugin; restrict access to plugin files via WAF, IP allowlisting, or authentication; monitor for unauthorized data access; apply virtual patching if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB