Is CVE-2026-11397 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11397 being exploited in the wild.

How severe is CVE-2026-11397?

Medium severity, with a CVSS score of 5.5, published 3 July 2026.

Which products and versions are affected?

Vjinfotech WP Import Export Lite up to and including 3.9.30.

Is there a fix for CVE-2026-11397?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11397 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11397?

Check whether you run Vjinfotech WP Import Export Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11397: vjinfotech WP Import Export Lite SSRF in URL downloader

CVE-2026-11397 · Severity: medium · CVSS 5.5 · Published 2026-07-03

The WP Import Export Lite plugin for WordPress, which is used to import and export site data, contains a security flaw that allows administrators to bypass internal network protections. By exploiting this vulnerability, an attacker with administrative access can force the server to make requests to internal systems or cloud metadata services that are normally restricted. This could lead to the exposure of sensitive internal information or unauthorized access to private cloud resources.

Technologies: Vjinfotech WP Import Export Lite. Vendors: Vjinfotech.

Quick answers

Is CVE-2026-11397 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11397 being exploited in the wild.
How severe is CVE-2026-11397?: Medium severity, with a CVSS score of 5.5, published 3 July 2026.
Which products and versions are affected?: Vjinfotech WP Import Export Lite up to and including 3.9.30.
Is there a fix for CVE-2026-11397?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11397 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11397?: Check whether you run Vjinfotech WP Import Export Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) located in the wpie_import_upload_file_from_url AJAX action. The plugin's Download::download_file() method initially uses wp_safe_remote_get() to validate URLs, which correctly blocks private IP ranges. However, if this call returns a WP_Error (which occurs when an internal host is blocked), the code falls back to using GuzzleHttp\Client::request() without any SSRF protections and with TLS verification disabled. This allows authenticated administrators to bypass intended restrictions and reach internal network resources or cloud metadata endpoints (e.g., 169.254.169.254). The issue is addressed in the trunk version (revision 3587811).

Affected products

vjinfotech WP Import Export Lite up to and including 3.9.30

Timeline

2026-07-03: advisory: NVD publication date
2026-07-03: disclosed: Wordfence advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.