Xserver Migrator
Monthly
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.