The WP Migrate Lite plugin for WordPress suffers from a Blind SSRF vulnerability (CWE-918) in the wpmdb_flush AJAX action. This flaw allows unauthenticated remote attackers to induce the server to send HTTP requests to arbitrary locations. The vulnerability affects all versions up to 2.7.6. The CVSS 3.1 base score is 5.8, reflecting a medium severity with network attack vector, no privileges required, and impact limited to partial confidentiality loss. No patch or remediation details have been provided by the vendor, and no exploits are currently known.

An attacker can leverage this SSRF vulnerability to make the vulnerable server send requests to arbitrary internal or external resources. This can be used to gather information about internal network services that are otherwise inaccessible, potentially aiding further attacks. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the AJAX action or implementing web application firewall rules to detect and block suspicious SSRF attempts. Monitor vendor communications for updates on patches or official mitigations.