CVE-2026-49043: WP Migrate Lite CSRF Vulnerability (Versions ≤2.7.8)

Technical summary

This vulnerability is a classic Cross-Site Request Forgery (CWE-352) affecting WP Migrate Lite up to version 2.7.8. The plugin fails to implement or properly validate CSRF tokens (also called nonces in WordPress terminology) on sensitive endpoints. An unauthenticated attacker can craft a request (via a hidden form, image tag, or JavaScript) that, when executed in a user's browser, performs privileged actions on the WordPress site without the user's explicit consent. The attack requires user interaction (opening a malicious link or visiting an attacker-controlled site while logged into WordPress) and can impact site integrity and confidentiality depending on which migration or export functions are abused. The CVSS vector indicates low attack complexity and network-based delivery, but requires user interaction and has limited impact scope.

Business impact

For WordPress site owners using WP Migrate Lite, this vulnerability risks unauthorized site migrations, data exfiltration, or misconfiguration of migration settings. An attacker could trigger a backup export or migration without the site administrator's knowledge, potentially compromising sensitive information or disrupting site operations. For agencies or hosting providers managing multiple WordPress sites, a single compromised admin account could be leveraged across multiple client sites if WP Migrate Lite is deployed widely. The MEDIUM severity rating reflects the requirement for user interaction and the primarily availability/integrity impact rather than immediate confidentiality breach.

Affected systems

WP Migrate Lite plugin versions 2.7.8 and earlier are affected. The vulnerability impacts WordPress installations with this plugin enabled and accessible to authenticated users. Any WordPress site running an affected version with users who have access to the migration tools is at risk if those users visit attacker-controlled content while logged in.

Exploitability

Exploitation requires user interaction—an authenticated WordPress user must visit an attacker-controlled webpage or click a malicious link while logged into their WordPress admin. The attack is network-based and requires no special privileges on the attacker's side, making it relatively straightforward to execute. However, the attacker must have knowledge of the target site's WordPress installation or conduct a broader phishing campaign. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, suggesting no widespread active exploitation has been publicly disclosed as of the publication date.

Remediation

Update WP Migrate Lite to a version greater than 2.7.8 immediately. Plugin developers should have released a patch addressing the missing or improper CSRF token validation. After patching, verify that the plugin properly implements WordPress nonces on all sensitive endpoints, particularly those related to migrations, exports, and configuration changes. Consider disabling the plugin on sites where it is no longer needed and restrict plugin access to only necessary users.

Patch guidance

Upgrade WP Migrate Lite beyond version 2.7.8. Access the WordPress plugin repository or your site's plugin dashboard to check for available updates. Test the patch in a staging environment first to ensure compatibility with your WordPress version and other plugins. After updating, clear any caches and verify migration functions operate as expected. If your hosting environment restricts direct updates, contact your hosting provider for assistance.

Detection guidance

Monitor WordPress admin access logs for unusual migration or export requests, especially those occurring outside business hours or from unexpected IP addresses. Review WordPress security logs for failed or suspicious CSRF-related errors. Implement security headers such as SameSite cookies to provide additional CSRF protection at the browser level. Use WordPress security scanning tools (such as Wordfence or Sucuri) to identify outdated plugin versions. Ensure logging is enabled for all plugin-related actions.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized for patching because: (1) WordPress sites are frequent attack targets; (2) CSRF attacks are easily weaponized via email and social engineering; (3) the migration functions affected can expose or alter sensitive site data; (4) updates are straightforward to deploy. Prioritize sites in critical infrastructure, e-commerce, or those handling sensitive customer data.

Risk score, explained

The CVSS 3.1 score of 4.7 (MEDIUM) reflects a network-based attack vector with low complexity, but requiring user interaction and offering limited impact scope (primarily availability). The attack does not directly compromise confidentiality or allow remote code execution, which keeps the score in the MEDIUM band. However, the real-world context—that WordPress administrators are frequently targeted and CSRF chains can be combined with other vulnerabilities—means organizations should weight business context alongside the numerical score.

Frequently asked questions