CVE-2025-11427 Overview
CVE-2025-11427 is a Blind Server-Side Request Forgery (SSRF) vulnerability in the WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress. The flaw affects all versions up to and including 2.7.6 and is reachable through the wpmdb_flush AJAX action. Unauthenticated attackers can force the vulnerable WordPress instance to issue arbitrary HTTP requests. This behavior can be abused to probe internal network services that are otherwise unreachable from the internet. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can pivot through vulnerable WordPress sites to enumerate internal services, cloud metadata endpoints, and other network resources hidden behind the perimeter.
Affected Products
- WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress
- All plugin versions up to and including 2.7.6
- WordPress sites exposing the wpmdb_flush AJAX endpoint
Discovery Timeline
- 2025-11-18 - CVE-2025-11427 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11427
Vulnerability Analysis
The WP Migrate Lite plugin exposes an AJAX handler registered under the wpmdb_flush action. This handler processes migration state data without adequately validating URL parameters that the plugin later fetches. Because the endpoint is reachable without authentication, any anonymous visitor can trigger outbound requests originating from the WordPress server. The response body is not returned to the attacker, which makes the issue a blind SSRF variant. Even without direct response reflection, attackers can measure timing differences and error behavior to infer whether internal hosts and ports are alive.
Root Cause
The root cause is missing validation of URL-like input processed by the flush logic in the plugin's migration persistence layer. The relevant code paths are Common/Migration/Flush.php and Common/MigrationPersistence/Persistence.php, referenced in the WordPress Plugin Code Review. User-controlled data flows into an HTTP request function without an allowlist check, hostname resolution filter, or restriction against private and link-local address ranges.
Attack Vector
An unauthenticated remote attacker sends a crafted POST request to wp-admin/admin-ajax.php with action=wpmdb_flush and attacker-controlled state values. The WordPress server then issues an HTTP request to the location supplied by the attacker. Targets typically include cloud instance metadata services such as http://169.254.169.254/, internal management interfaces, and localhost-bound admin panels. See the CleanTalk CVE-2025-11427 Analysis and the Wordfence Threat Intelligence Report for additional technical context.
Detection Methods for CVE-2025-11427
Indicators of Compromise
- Unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=wpmdb_flush
- Outbound HTTP requests from the web server to private IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or the link-local 169.254.169.254 metadata address
- Bursts of requests to the wpmdb_flush endpoint from a single external source, consistent with SSRF probing
Detection Strategies
- Inspect web server access logs for wpmdb_flush AJAX calls originating from unauthenticated sessions or unusual user agents
- Correlate WordPress request logs with egress firewall logs to identify server-initiated connections that follow inbound wpmdb_flush traffic
- Deploy web application firewall rules that flag or block requests supplying URL parameters to the wpmdb_flush action
Monitoring Recommendations
- Alert on any outbound request from WordPress hosts targeting 169.254.169.254 or other cloud metadata endpoints
- Baseline normal outbound destinations for web servers and generate alerts on new internal targets
- Monitor the WP Migrate Lite plugin version across managed sites and flag installations at 2.7.6 or earlier
How to Mitigate CVE-2025-11427
Immediate Actions Required
- Update WP Migrate Lite to a version later than 2.7.6 as soon as the vendor publishes a fixed release
- Restrict access to /wp-admin/admin-ajax.php?action=wpmdb_flush at the web server or WAF layer until patching is complete
- Enforce egress filtering on WordPress hosts so that outbound traffic to private, loopback, and link-local ranges is blocked by default
Patch Information
The vulnerability affects all WP Migrate Lite versions through 2.7.6. Site operators should monitor the plugin's official channels and the Wordfence Threat Intelligence Report for the fixed release version and upgrade immediately upon availability.
Workarounds
- Disable or uninstall the WP Migrate Lite plugin until an updated version is applied
- Deploy a WAF rule that blocks unauthenticated POST requests with the wpmdb_flush action parameter
- Apply IMDSv2 on AWS instances and equivalent metadata protections on Azure and GCP to limit SSRF impact against cloud metadata services
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
