CVE-2025-11427

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11427", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-07T12:01:47.052Z", "datePublished": "2025-11-18T11:00:48.436Z", "dateUpdated": "2026-04-08T16:50:54.588Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:54.588Z"}, "affected": [{"vendor": "wpengine", "product": "WP Migrate Lite \u2013 Migration Made Easy", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Migrate Lite \u2013 WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services."}], "title": "WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b098711-ed01-4a71-b0df-30ff4fffa930?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/MigrationPersistence/Persistence.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/Migration/Flush.php#L69"}, {"url": "https://research.cleantalk.org/cve-2025-11427/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-09-24T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-17T22:17:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T20:47:41.237995Z", "id": "CVE-2025-11427", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:50:27.147Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11427", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T20:47:41.237995Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:50:24.576Z"}}], "cna": {"title": "WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "wpengine", "product": "WP Migrate Lite \u2013 Migration Made Easy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-24T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-17T22:17:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b098711-ed01-4a71-b0df-30ff4fffa930?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/MigrationPersistence/Persistence.php#L50"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/Migration/Flush.php#L69"}, {"url": "https://research.cleantalk.org/cve-2025-11427/"}], "descriptions": [{"lang": "en", "value": "The WP Migrate Lite \u2013 WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:54.588Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11427", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:54.588Z", "dateReserved": "2025-10-07T12:01:47.052Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T11:00:48.436Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Migrate Lite \u2013 Migration Made Easy", "vendor": "wpengine", "versions": [{"lessThanOrEqual": "2.7.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Migrate Lite \u2013 WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.7.6 via the wpmdb_flush AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to obtain information about internal services."}, {"lang": "es", "value": "El plugin WP Migrate Lite - WordPress Migration Made Easy para WordPress es vulnerable a Server-Side Request Forgery ciega en todas las versiones hasta la 2.7.6, inclusive, a trav\u00e9s de la acci\u00f3n AJAX wpmdb_flush. Esto hace posible que atacantes no autenticados realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede usarse para obtener informaci\u00f3n sobre servicios internos."}], "id": "CVE-2025-11427", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11427", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T20:47:41.237995Z", "version": "2.0.3"}}]}, "published": "2025-11-18T11:15:44.193", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/Migration/Flush.php#L69"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-migrate-db/tags/2.7.5/class/Common/MigrationPersistence/Persistence.php#L50"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-11427/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b098711-ed01-4a71-b0df-30ff4fffa930?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:23:18.545996+00:00", "value": {"mitigation_remediation": ["Upgrade WP Migrate Lite to the latest released version that resolves the SSRF flaw", "If an upgrade cannot be performed immediately, remove or deactivate the plugin entirely", "Block unauthenticated requests to the wpmdb_flush action by configuring a web application firewall or security plugin to limit access to admin\u2011ajax.php"], "summary": {"action": "Patch", "impact": "Blind Server\u2011Side Request Forgery (unauthenticated)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects installations of the WP Migrate Lite plugin branded by wpengine. Any WordPress site running version 2.7.6 or earlier is exposed, regardless of server configuration or other plugins.", "description_and_impact": "The WP Migrate Lite WordPress migration plugin harbors an unauthenticated Blind Server\u2011Side Request Forgery flaw in all versions up to and including 2.7.6. The issue is triggered through the wpmdb_flush AJAX action and permits an attacker to force the server to send HTTP requests to arbitrary URLs from within the application. Though the SSRF is blind and no direct response is returned, the attacker can glean the existence of internal services or discover network topology details.", "risk_and_exploitability": "The CVSS score of 5.8 indicates moderate risk, while the EPSS score of less than 1% suggests low current exploitation probability. The flaw is not listed in the CISA KEV catalog, so no publicly known exploits are available. Unauthenticated attackers can trigger the vulnerability from any internet\u2011reachable location that can access the WordPress site. Although the SSRF is blind, it offers valuable reconnaissance opportunities and could serve as a stepping stone to further attacks within the internal network."}}}}, "created": "2025-11-19T10:48:10.829880+00:00", "updated": "2026-04-22T12:30:16.832765+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpengine", "wpengine$PRODUCT$wp_migrate"]}