Junglewise Threat Intelligence

CVE-2026-11397: vjinfotech WP Import Export Lite SSRF in URL downloader

CVE-2026-11397 · Severity: medium · CVSS 5.5 · Published 2026-07-03

Technologies: Vjinfotech WP Import Export Lite. Vendors: Vjinfotech.

Executive brief

The WP Import Export Lite plugin for WordPress, which is used to import and export site data, contains a security flaw that allows administrators to bypass internal network protections. By exploiting this vulnerability, an attacker with administrative access can force the server to make requests to internal systems or cloud metadata services that are normally restricted. This could lead to the exposure of sensitive internal information or unauthorized access to private cloud resources.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) located in the wpie_import_upload_file_from_url AJAX action. The plugin's Download::download_file() method initially uses wp_safe_remote_get() to validate URLs, which correctly blocks private IP ranges. However, if this call returns a WP_Error (which occurs when an internal host is blocked), the code falls back to using GuzzleHttp\Client::request() without any SSRF protections and with TLS verification disabled. This allows authenticated administrators to bypass intended restrictions and reach internal network resources or cloud metadata endpoints (e.g., 169.254.169.254). The issue is addressed in the trunk version (revision 3587811).

Affected products

  • vjinfotech WP Import Export Lite up to and including 3.9.30

Timeline

  • 2026-07-03: advisory: NVD publication date
  • 2026-07-03: disclosed: Wordfence advisory published

References