Hostinger Migrator
Monthly
Unauthenticated Broken Access Control in the Hostinger Migrator WordPress plugin (version 1.0 and earlier) lets any remote attacker reach a plugin endpoint that performs no authorization check, exposing migration and backup artifacts such as database dumps, file archives and site configuration data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) the impact is a high-confidentiality breach with no integrity or availability effect, exploitable against default installations with no credentials, user interaction or special configuration. No public exploit identified at time of analysis, and no EPSS score or CISA KEV entry was supplied; the practical risk is bounded by the plugin's niche adoption and the fact that migration plugins are often left active only briefly during a site move, so sites that have deactivated or removed the plugin since migrating are not exposed.
Unauthenticated Broken Access Control in the Hostinger Migrator WordPress plugin (version 1.0 and earlier) lets any remote attacker reach a plugin endpoint that performs no authorization check, exposing migration and backup artifacts such as database dumps, file archives and site configuration data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) the impact is a high-confidentiality breach with no integrity or availability effect, exploitable against default installations with no credentials, user interaction or special configuration. No public exploit identified at time of analysis, and no EPSS score or CISA KEV entry was supplied; the practical risk is bounded by the plugin's niche adoption and the fact that migration plugins are often left active only briefly during a site move, so sites that have deactivated or removed the plugin since migrating are not exposed.