This vulnerability in WP Migrate allows an attacker to exploit unsafe deserialization of untrusted data, potentially enabling remote code execution or other severe impacts. The affected versions include all releases up to 2.6.10. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code remotely, leading to full system compromise including loss of confidentiality, integrity, and availability of the affected system. This represents a critical security risk for users of WP Migrate versions up to 2.6.10.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to WP Migrate to trusted administrators only and monitor for updates from WPENGINE, INC. Avoid exposing the plugin to untrusted networks or users.