The WP Migrate Lite WordPress migration plugin harbors an unauthenticated Blind Server‑Side Request Forgery flaw in all versions up to and including 2.7.6. The issue is triggered through the wpmdb_flush AJAX action and permits an attacker to force the server to send HTTP requests to arbitrary URLs from within the application. Though the SSRF is blind and no direct response is returned, the attacker can glean the existence of internal services or discover network topology details.

The vulnerability affects installations of the WP Migrate Lite plugin branded by wpengine. Any WordPress site running version 2.7.6 or earlier is exposed, regardless of server configuration or other plugins.

The CVSS score of 5.8 indicates moderate risk, while the EPSS score of less than 1% suggests low current exploitation probability. The flaw is not listed in the CISA KEV catalog, so no publicly known exploits are available. Unauthenticated attackers can trigger the vulnerability from any internet‑reachable location that can access the WordPress site. Although the SSRF is blind, it offers valuable reconnaissance opportunities and could serve as a stepping stone to further attacks within the internal network.