The Hostinger Migrator plugin for WordPress allows an attacker to perform privileged actions without authentication. Due to improper permission checks, any user can trigger the plugin’s webhooks or export functions, potentially compromising site data or configuration. This vulnerability can enable unauthorized access to administrative features and data retrieval, thereby exposing sensitive information and undermining site integrity.

WordPress sites that have installed Hostinger Migrator plugin version 1.0 or earlier are affected. The vulnerability spans all WordPress installations running these legacy plugin versions regardless of custom configuration, as the flaw resides in the plugin’s core code. Sites that have upgraded to 1.1.0 or later are no longer vulnerable.

The CVSS score of 7.5 indicates high severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves unauthenticated HTTP requests to the plugin’s exposed endpoints. An attacker can exploit this flaw without needing any user credentials, making the risk significant for any publicly accessible WordPress site using the vulnerable plugin.