EUVD-2026-41489
GHSA-w7wg-w2g9-vmjq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Admin authentication required (PR:H), network-accessible AJAX endpoint (AV:N), scope changes to internal services reachable from server (S:C), with limited confidentiality and integrity impact only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. The plugin's URL downloader first calls wp_safe_remote_get() (which correctly blocks private/reserved IP ranges), but when that call returns a WP_Error - the exact outcome for any blocked internal host - the Download::download_file() method falls back to GuzzleHttp\Client::request() with the original attacker-supplied URL and no SSRF protection (and with TLS verification disabled). This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services such as the cloud metadata endpoint at 169.
AnalysisAI
Server-Side Request Forgery in WP Import Export Lite (all versions ≤ 3.9.30) allows authenticated administrators to bypass WordPress's native SSRF protections and reach internal network resources, including cloud instance metadata endpoints. The bypass exploits a design flaw: when WordPress's wp_safe_remote_get() correctly blocks a private-range URL and returns a WP_Error, the plugin's Download::download_file() method interprets that error as a cue to retry the original attacker-supplied URL via GuzzleHttp with no filtering and TLS verification disabled. No public exploit is identified at time of analysis and no CISA KEV listing exists, but the cloud credential theft scenario on hosted WordPress environments elevates practical impact beyond the 5.5 base score.
Technical ContextAI
The vulnerability exists within the wpie_import_upload_file_from_url AJAX action of the WP Import Export Lite plugin by VJInfotech (CPE: cpe:2.3:a:vjinfotech:wp_import_export_lite:*:*:*:*:*:*:*:*). The plugin's URL import pipeline first invokes WordPress's wp_safe_remote_get(), a wrapper that enforces a blocklist of private and reserved IP ranges (RFC 1918, link-local 169.254.0.0/16, loopback, etc.). The flaw is that a WP_Error return from this function - the precise outcome for any blocked internal host - triggers a fallback to GuzzleHttp\Client::request() using the original, unmodified attacker-supplied URL. This fallback carries neither the IP-range blocklist nor TLS certificate validation. The root cause class is CWE-918 (Server-Side Request Forgery), specifically a security-control bypass pattern where a second code path re-issues the same request without the protections present in the first. Source code references confirm the vulnerable logic in download.php (L31, L97) and the URL upload extension classes on the WordPress plugin Trac.
RemediationAI
An upstream fix has been committed to the plugin's WordPress.org trunk (revision 3587811, viewable at the trunk download.php Trac reference), but a specific released patched version number beyond 3.9.30 is not confirmed in the available data - administrators should monitor the WordPress.org plugin page and apply any update above 3.9.30 as soon as it is published. As an immediate compensating control, disabling or restricting access to the URL import feature (wpie_import_upload_file_from_url AJAX action) eliminates the attack surface without removing the plugin entirely; note this disables URL-based import functionality for all users. On cloud-hosted instances, enforcing AWS IMDSv2 (requiring session-oriented tokens that a simple Guzzle GET cannot obtain), or applying host/network-level firewall rules blocking 169.254.169.254, mitigates the most critical pivot scenario - cloud credential theft - even if the plugin remains active; this has no impact on the WordPress application itself. The Wordfence advisory should be monitored for patch release confirmation and updated version numbers.
More in Wp Import Export Lite
View allThe WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati
The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ fu
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.9.26. Rated medium severity (CVSS 4.
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during t
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it a
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it re
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing expo
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today