What is the CVSS score of CVE-2026-4328?

CVE-2026-4328 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Advanced Import CVE-2026-4328

EUVD-2026-37984 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-19 Wordfence

GHSA-qvcr-v37j-859c

WordPress XSS SSRF Wordpress Plugin Advanced Import

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

PR:L reflects mandatory Author-level authentication; S:C applies because server-side requests escape the WordPress application boundary into internal infrastructure.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 06:36 vuln.today

CVE Published

Jun 19, 2026 - 04:31 nvd

MEDIUM 6.4

DescriptionCVE.org

The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This is due to the plugin using wp_remote_get() to fetch a user-supplied URL without validating that the URL does not point to internal or private network resources in the demo_download_and_unzip() function. The 'demo_file' parameter from $_POST is passed through sanitize_text_field() (which only handles XSS-related sanitization) and then directly into wp_remote_get() when 'demo_file_type' is set to 'url'. Notably, the plugin uses wp_safe_remote_get() in other locations (theme template libraries) which would provide SSRF protection, but fails to use it in this critical AJAX handler. This makes it possible for authenticated attackers, with Author-level access and above (upload_files capability), to make web requests to arbitrary locations originating from the web application, which can be used to query and view data from internal services, including cloud instance metadata endpoints.

AnalysisAI

Server-Side Request Forgery in the Advanced Import WordPress plugin (all versions through 1.4.6) allows authenticated users holding Author-level access or higher to force the web server to issue HTTP requests to arbitrary internal or external URLs via the demo_download_and_unzip() AJAX handler. The critical design flaw is the inconsistent use of wp_remote_get() instead of WordPress's own wp_safe_remote_get() - which the plugin correctly employs elsewhere - meaning no SSRF-aware URL validation is applied to the 'demo_file' POST parameter when 'demo_file_type' is set to 'url'. No public exploit code has been identified at time of analysis, but the scope change in the CVSS vector reflects that successful exploitation escapes the WordPress application boundary and can reach internal network services, including cloud instance metadata endpoints such as AWS IMDSv1.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) arises here because the plugin's AJAX handler demo_download_and_unzip() - located at class-advanced-import-admin.php line 612 - accepts user-controlled input via $_POST['demo_file'], passes it through sanitize_text_field() (a function designed only to strip HTML/XSS content, not validate URL destination), and then supplies the result directly to WordPress's wp_remote_get(). WordPress provides wp_safe_remote_get() precisely to block SSRF by rejecting requests to loopback addresses, link-local ranges (169.254.x.x used by AWS/GCP/Azure metadata services), and private RFC-1918 subnets. The plugin authors correctly used wp_safe_remote_get() for theme template library fetching (line 561) but omitted it in this critical code path. The affected CPE is cpe:2.3:a:addonspress:advanced_import:*:*:*:*:*:*:*:* covering all plugin releases through 1.4.6. The SSRF occurs in an AJAX context, meaning it is invoked over HTTP via the WordPress admin-ajax.php endpoint rather than requiring direct server access.

RemediationAI

The upstream fix has been committed to the WordPress plugin SVN repository as changeset 3566433; however, no specific released patched version number is independently confirmed from the available reference data - site operators should verify whether a version newer than 1.4.6 is available in the WordPress plugin directory and upgrade immediately upon confirmation. The correct code-level fix is replacing wp_remote_get() with wp_safe_remote_get() in the demo_download_and_unzip() AJAX handler, consistent with how the plugin already handles URL fetching in other contexts. As a compensating control until patching is possible, administrators can restrict access to admin-ajax.php actions for untrusted Author-level accounts via a WAF rule blocking POST requests containing 'demo_file_type=url', though this may break the demo import feature. Alternatively, removing Author-role accounts or downgrading untrusted users to Contributor (which lacks upload_files capability) eliminates the exploitation prerequisite entirely. On cloud-hosted instances, enabling IMDSv2 (session-token-required metadata) on the underlying EC2 or equivalent instance prevents metadata credential theft via SSRF, though this does not address other internal network exposure. Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/baf55ce7-8a33-426c-a6a4-158a95a13a5c.