CVE-2024-33913 CRITICAL

CVE-2024-33913: WordPress Xserver Migrator plugin <= 1.6.1 - CSRF to Arbitrary File Upload vulnerability

Vendor Xserver Migrator
Product Xserver Migrator
Weakness CWE-352 · CSRF
Published May 2, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6.1.

Explanation of Vulnerability in Simple Terms

02Summary

Xserver Migrator versions up to 1.6.1 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick a site administrator into performing unintended actions. The vulnerability requires user interaction—the admin must visit a malicious page or click a crafted link while logged in. Successful exploitation can lead to unauthorized changes, data theft, or service disruption.

What an attacker can do

03Attacker Capabilities

Trick an admin into performing unintended actions like changing settings, deleting data, or creating accounts.

Potential impact on your site

04Site Impact

An attacker can modify site configuration, steal data, or disrupt service if an admin is tricked into visiting a malicious page.

Conditions required to exploit

05Prerequisites

Admin must be logged in and visit an attacker-controlled page or click a malicious link.

Key dates

06Disclosure timeline

May 2, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15070 Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-65460 WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-61981 WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-65488 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability