Migratico Lite
Monthly
Unauthenticated remote code execution in Migratico Lite, a WordPress site-migration plugin, affects all versions up to and including 2.6.8 and lets a remote attacker who can reach an affected site inject and execute arbitrary code with the privileges of the web server. The vendor-disclosed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0, reported by Patchstack) requires no authentication and no user interaction, so any WordPress installation running an affected plugin version is potentially exposed; our independent assessment keeps the same network/authentication profile but scores scope as unchanged (S:U), giving an effective base score of 9.8. Exploitation is tempered by practical limits: Migratico Lite is a niche migration plugin with a modest install base, and the sparse public advisory does not disclose the vulnerable endpoint or parameter, so no public exploit code has been identified at time of analysis and weaponization currently depends on an attacker locating the injection sink themselves. There is no CISA KEV entry for this CVE.
Unauthenticated remote code execution in Migratico Lite, a WordPress site-migration plugin, affects all versions up to and including 2.6.8 and lets a remote attacker who can reach an affected site inject and execute arbitrary code with the privileges of the web server. The vendor-disclosed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0, reported by Patchstack) requires no authentication and no user interaction, so any WordPress installation running an affected plugin version is potentially exposed; our independent assessment keeps the same network/authentication profile but scores scope as unchanged (S:U), giving an effective base score of 9.8. Exploitation is tempered by practical limits: Migratico Lite is a niche migration plugin with a modest install base, and the sparse public advisory does not disclose the vulnerable endpoint or parameter, so no public exploit code has been identified at time of analysis and weaponization currently depends on an attacker locating the injection sink themselves. There is no CISA KEV entry for this CVE.