Executive brief
The WP Import Export Lite WordPress plugin fails to properly validate URLs during the import process, allowing administrators to trigger the site to make requests to internal servers and read their responses. This could expose sensitive internal services, configuration details, or allow reconnaissance of a site's infrastructure without authorization.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the import functionality of WP Import Export Lite. The plugin does not properly validate or filter URLs before making HTTP requests during import operations. An attacker with administrator privileges (or any user with the import capability) can craft malicious import requests targeting internal hosts and services, causing the vulnerable server to issue requests to internal resources and return their responses. This is an incomplete fix for a prior vulnerability (CVE-2026-11397). The vulnerability requires authentication (import capability, typically administrator-level) and is fixed in version 3.9.33.
Affected products
- WordPress WP Import Export Lite before 3.9.33
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 3.9.33