CVE-2026-62104Wordfence

Vulnerability Summary

The Migratico Lite plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.6.8. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for unauthenticated attackers to execute arbitrary code on the server.

Severity Level

CRITICAL(9.8)

Published Date

Sep 17, 2026

Last Modified

Sep 22, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.59%Probability

Root Weakness (CWE)

CWE-94: Code Injection ↗

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended syntax or behavior.

CVSS v3.1 Base Metrics — Score 9.8 (CRITICAL)

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

Affected & Patched Versions

Affected Versions

Migratico Lite * - 2.6.8

Patched Versions

Migratico Lite 1

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.