Junglewise Threat Intelligence

CVE-2026-4328: WordPress Advanced Import SSRF in demo_download_and_unzip

CVE-2026-4328 · Severity: medium · CVSS 6.4 · Published 2026-06-19

Executive brief

The Advanced Import plugin for WordPress, which is used to import content and demo data, contains a security flaw that allows authorized users to make unauthorized network requests from the web server. An attacker with Author-level permissions could use this to probe internal company networks or access sensitive cloud configuration data that is normally hidden from the public internet. This could lead to further internal network compromise or the exposure of private infrastructure details.

Technical details

The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) due to the use of the insecure wp_remote_get() function in the demo_download_and_unzip() AJAX handler. The 'demo_file' POST parameter is passed to this function without sufficient validation to ensure the URL does not point to internal or private network resources. While the plugin uses the more secure wp_safe_remote_get() in other components, this specific handler only applies XSS-related sanitization via sanitize_text_field(). Authenticated attackers with Author-level access (upload_files capability) can exploit this to query internal services or cloud instance metadata endpoints (e.g., IMDSv1/v2). The vulnerability is present in all versions up to and including 1.4.6.

Affected products

  • addonspress Advanced Import up to, and including, 1.4.6

Timeline

  • 2026-06-19: advisory: NVD publication date

References