A Cross‑Site Request Forgery flaw in the WING WordPress Migrator plugin enables an attacker to craft a request that makes an authenticated user unknowingly upload a malicious web shell to the web server. The vulnerability allows the execution of arbitrary code on the server, leading to full compromise of the site’s confidentiality, integrity, and availability. The weakness is categorized as CWE‑352 because the plugin does not verify a correct anti‑CSRF token before processing upload actions.

WordPress sites running the ConoHa by GMO WING WordPress Migrator plugin at any version up to and including 1.2.0 are affected. No specific build or patch numbers were listed in the advisory, but all releases through 1.2.0 lack the necessary CSRF protection for the upload endpoint.

The CVSS score of 9.6 indicates critical severity, and the EPSS score of less than 1% suggests a lower probability of immediate exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the upload by luring an authenticated user to visit a crafted URL, or by sending a forged request from another domain if CSRF tokens are missing. The attack can succeed without user interaction beyond following a link or submitting a form, making it an attractive vector for mass exploitation if mitigations are not in place.