Migratico Lite

Migratico Lite has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Code Injection, behind 1 of the records (100%).

The one issue recorded for Migratico Lite has a vendor fix available, so running the current release closes it.

All of these findings were reported by Ananda Dhakal. Migratico Lite is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.6.

Strategic Overview

Avg CVSSCritical
9.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Migratico Lite vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-62104

Migratico Lite <= 2.6.8 - Unauthenticated Remote Code Execution

Read the full analysis

Vulnerability Records

1 records
Migratico Lite banner
Latestv2.7.1

Migratico Lite

superweby

Author

superweby

0.0(0)
0/100
Last Updated
2026-09-07 (16d ago)
Active Installs
10+
Downloads
1,027
Requires WP
5.3+
Requires PHP
7.4+
Tested up to
WP 7.0.6
Created
2026-03-11 (7mo ago)

WordPress Migration & Backup Plugin Migratico Lite provides a simple way to move WordPress sites, create reliable backups, or clone a site for development. With Migratico, you can easily migrate, transfer, or clone your WordPress site between domains or hosts with no downtime. Create full backups of your website, or package your entire site to download and install elsewhere with only a few steps. At Migratico, reliability, security, and ease of use are our top priorities. Our intuitive migration wizard and real-time progress tracking make Migratico one of the most beginner-friendly backup and migration plugins on the market. You don’t have to hire a developer. Create a backup and migrate sites in just a few minutes. Easy Site Migration, Backup, and Cloning Migratico streamlines site migrations by packaging your website files and database into downloadable archives. Download and re-install your backup on any new WordPress location or server without dealing with complicated setups. The installer works on an empty server – no need to install WordPress first. Fast WordPress Migrations Migratico makes WordPress website migrations fast and stress-free. Quickly move to a new host, domain, or server. No downtime, no data loss, and no coding required. Reliable WordPress Backups Create complete backups of your WordPress site including database and files. Perfect for: – Pre-update backups – Development site copies – Disaster recovery – Moving to new hosting WooCommerce Migration Support Migratico offers reliable WooCommerce migration and backup. Easily migrate your entire online store including: – Products and categories – Orders and customers – Payment settings – Custom product data Large Database Support Migratico handles databases of any size with automatic timeout recovery: – Chunk-based import prevents memory issues – Automatic resume after PHP timeouts – No file size limits – Tested with databases over 1GB Real-time Progress Tracking Watch your migration in real-time with streaming progress updates: – Live progress bar during installation – Detailed status messages – Automatic recovery from timeouts – Up to 50 automatic resume attempts Smart Migration Wizard Migratico’s smart migration wizard makes transferring your website effortless: – 4-step installation process – Environment compatibility check – Database connection testing – Automatic URL rewriting – wp-config.php updates Clone WordPress Website Migratico clones your entire WordPress website quickly and easily. Perfect for: – Staging sites – Development environments – Testing updates – Client demos Key Features Complete Site Export – Database and files in one package Automatic ZIP Splitting – Large sites split into manageable archives Real-time Progress – Live updates during installation Auto-Resume – Continues after server timeouts Smart URL Rewriting – Updates all URLs automatically Database Connection Test – Verify settings before installation Multi-language – Available in Czech, German, and English No External Dependencies – Everything runs on your server Security Focused – No data sent to external servers Who Should Use Migratico? Migratico is perfect for: – Website Owners moving to new hosting – Developers creating staging sites – Agencies migrating client sites – E-commerce Sites with large databases – Anyone needing reliable WordPress backups Usage Creating a Migration Package Go to Migratico Lite > Create Package Enter a package name Set maximum ZIP file size (recommended: 100MB for most hostings) Optionally exclude directories (cache, logs, etc.) Click Create Package and wait for completion Downloading the Package Go to Migratico Lite main page Click download buttons for your created package: migratico.php – Installation wizard database.sql.zip – Database export files_001.zip, files_002.zip, etc. – Site files Installing on New Server Upload all package files to your new server Open migratico.php in your browser Follow the 4-step wizard: Step 1: Environment check Step 2: Database settings (with connection test) Step 3: Site settings Step 4: Installation with real-time progress After successful installation, delete all package files for security Security The wp-content/uploads/migratico/ directory is sensitive: migration packages contain the full database (including user hashes) and a copy of the site files. Migratico Lite protects this directory with deny-all .htaccess / web.config rules, a per-package migration secret that must be entered manually in the installer, and automatic package expiration after 4 hours (adjustable via the migratico_package_ttl filter). nginx users: nginx does not process .htaccess files. Add this to your server block: location ^~ /wp-content/uploads/migratico/ { deny all; return 403; } The plugin detects nginx and displays a warning in the WordPress admin until this is configured. Notes: – Package files are downloaded only through a nonce- and capability-protected (manage_options) AJAX endpoint. – The generated installer (migratico.php) refuses every request — page views, form submissions and AJAX endpoints — until the per-package migration secret is entered on its welcome screen. Only the SHA-256 hash of that secret is stored in the package and embedded in the installer; the raw secret is shown once in the WordPress admin when the package is created and is never written to disk, logs or URLs. – Migration packages (completed or interrupted) are automatically deleted after their TTL via WP-Cron. Credits Developed by Miroslav Novotny Website: https://migratico.com Support: https://migratico.com/support License This plugin is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This plugin is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C