Affected versions: 1.2.5 and earlier ·
Fixed in: 1.2.6 and 1.2.7 ·
CVE: CVE-2026-15046 ·
Severity: Medium (CVSS 4.2)
Summary
A security researcher reported a vulnerability in the way our WordPress migration plugin installed and authenticated its migration connector. We released fixes in versions 1.2.6 and 1.2.7, and both are available now through the WordPress plugin directory.
If you are running version 1.2.5 or earlier, update immediately. If you have finished your migration, we recommend deleting the plugin entirely.
What the issue was
The plugin’s connector is a small bridge file created during a migration so that data can be transferred into your store. Two problems existed in how it worked:
Missing CSRF protection. The administrative action that installed or updated the connector’s authentication token read that token from a URL parameter and did not verify a WordPress nonce. An attacker could craft a link that, if opened by a logged-in administrator, would overwrite the connector token with a value the attacker chose. The attacker did not need credentials for your site — only for an administrator to click the link while logged in.
An over-permissive connector. The connector authorised requests using that token alone, and had broader capabilities than a migration tool requires. Combined with the first issue, a researcher demonstrated that a controlled token could be used to write and execute code on the site.
We want to state this plainly: this was not a low-impact issue for sites that met the conditions below. We have treated it accordingly.
Who was affected
The connector bridge file only exists after a migration has been set up. It is not present on a fresh install. If you installed the plugin but never started a migration, this issue could not be triggered on your site.
Sites running 1.2.5 or earlier with a connector installed were the ones at risk.
What we fixed
In 1.2.6:
- Installing, reinstalling and removing the connector now require administrator capability and a WordPress nonce, so they cannot be triggered by a cross-site request.
- The connector token is generated on your site with a cryptographically secure random generator, and is never read from a URL parameter.
- The connector is no longer downloaded from a remote server; it is a generated bridge running code shipped and reviewed with the plugin.
- The connector can no longer read, write or move files outside the WordPress uploads folder, and can never write a file the web server would execute.
- Database manager, phpinfo, opcache and free-form SQL console actions were removed entirely.
- Any connector installed by 1.2.5 or earlier is removed on upgrade and its token revoked.
- Added a REST route so migrations can be set up using WordPress Application Passwords.
In 1.2.7: further restrictions on the connector’s file copy action and directory listings.
What you should do
- Update to 1.2.7. Upgrading automatically removes any old connector and revokes its token.
- If your migration is complete, delete the plugin. It is a migration tool and does not need to stay installed. This removes the connector endpoint entirely.
- If you ran 1.2.5 or earlier with a connector installed, review your site for unexpected files (particularly PHP files with recent modification dates), unfamiliar administrator accounts, and unusual scheduled tasks. Reviewing your access logs for requests to
le_connector/connector.phpis a good starting point. - If you find anything unexpected, contact us at [security email]. We will help you investigate at no cost.
Has any data been affected?
We have no evidence that this vulnerability was exploited against any site. It was reported through responsible disclosure, not discovered through an incident.
We want to be accurate rather than simply reassuring. Exploitation would leave traces on the affected WordPress site, not on LitExtension’s systems, so we cannot verify the state of every installation on our users’ behalf — which is why we are asking site owners to perform the checks above. Our own infrastructure was not affected, and we do not retain migration data or store credentials after a migration completes.
A note on vulnerability databases
Some vulnerability scanners currently list the affected range as “1.2.7 and earlier”. This is inaccurate — the CSRF issue was fixed in 1.2.6. We have contacted the relevant databases to correct the record. Sites running 1.2.7 may see a false positive until this is updated.
Acknowledgement
We thank marim00 for reporting this responsibly, and for the detail provided in the report. Our changelog for 1.2.6 credits this disclosure.
Reporting security issues
Please email [email protected]. We aim to acknowledge reports within 1 business day and will not pursue legal action against researchers acting in good faith.
