The Xserver Migrator plugin for WordPress allows an unauthenticated attacker to access sensitive information. The vulnerability is present in all releases up to and including version 1.6.6, enabling external parties to read data that should be protected by authentication. This can lead to disclosure of user credentials, migration data, or other private content stored by the plugin.

Any WordPress installation that uses the Xserver Migrator plugin version 1.6.6 or earlier is affected. The vulnerability applies specifically to the Xserver Migrator plugin distributed by the XServer vendor.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The likely attack vector is unauthenticated external access to the plugin's data endpoints.