WP Import Export Lite SSRF Vulnerability (CVE-2026-11397): Admin Exploitation, Cloud Metadata Risk

Technical summary

The vulnerability exists in the wpie_import_upload_file_from_url AJAX action. The plugin's upload handler calls wp_safe_remote_get() first, which correctly rejects requests to private and reserved IP ranges per WordPress security policy. When wp_safe_remote_get() returns a WP_Error (the expected outcome for blocked internal hosts), the code invokes a fallback Download::download_file() method using GuzzleHttp\Client::request(). This fallback operates without SSRF protections and explicitly disables TLS certificate verification, allowing unauthenticated, arbitrary URL fetching from the server's network context. An attacker with administrator credentials can exploit this to query metadata endpoints (169.254.169.254 for AWS, similar ranges for other cloud providers) or internal services.

Business impact

Organizations using WP Import Export Lite face risk of credential theft if cloud metadata is exposed, potential reconnaissance of internal infrastructure, and compromise of adjacent services if the WordPress server can reach them. The vulnerability requires admin-level access, limiting blast radius to compromised or malicious administrators, but in multi-tenant or managed WordPress environments this could affect other customers. Data exfiltration from internal APIs, databases, or monitoring systems becomes possible if reachable from the web tier.

Affected systems

WordPress installations running WP Import Export Lite plugin version 3.9.30 and all earlier versions. The vulnerability requires authenticated access with administrator or higher privilege level to trigger, so installations with strong admin access controls are at lower immediate risk. However, any admin account compromise or insider threat can activate this vulnerability.

Exploitability

Exploitation requires valid administrator credentials and direct access to the WordPress admin panel or authenticated AJAX endpoints. The attack surface is narrow—limited to users who already have significant privileges—but once inside, the attacker can directly initiate SSRF requests without additional interaction or user interaction required. The attack is straightforward to execute once credentials are obtained; no complex exploitation techniques needed.

Remediation

Upgrade WP Import Export Lite to a patched version released after July 6, 2026 that implements proper SSRF protections in all code paths, including fallback mechanisms. Verify the patched version properly validates and restricts destination URLs regardless of which HTTP client is used. As an interim measure, restrict administrator account access to only trusted individuals, monitor admin logins, and consider disabling the URL import feature in the plugin settings if available until patching is complete.

Patch guidance

Consult the WP Import Export Lite plugin repository or vendor advisory for the version number that resolves this issue. Apply the update through the WordPress admin dashboard or via direct plugin update mechanisms once available. Test the patched version in a staging environment first to ensure no conflict with custom import workflows. Verify that after patching, attempts to import from internal IP ranges are consistently blocked.

Detection guidance

Monitor WordPress admin activity logs for unusual wpie_import_upload_file_from_url AJAX requests, especially those originating from unexpected IP addresses or accompanied by suspicious URL parameters. Check web application firewall logs for outbound requests to cloud metadata endpoints (169.254.169.254 or similar) or internal IP ranges initiated by the WordPress process. Review GuzzleHttp client logs if available. Implement network segmentation to prevent web servers from reaching metadata endpoints or internal services that require strict access controls.

Why prioritize this

Although rated MEDIUM severity, this vulnerability poses outsized risk in cloud-hosted environments where metadata endpoints contain temporary credentials with high-impact permissions. The requirement for admin access limits immediate threat, but compromised WordPress admin accounts are common targets. Priority should be elevated in organizations running on AWS, Azure, GCP, or similar platforms where metadata exfiltration directly enables lateral movement and data theft.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects the requirement for administrator privileges (PR:H), network-based attack vector (AV:N), and the ability to impact confidentiality and integrity across different security contexts (S:C/C:L/I:L). The score does not fully capture the practical risk in cloud environments or the value of compromised metadata; organizations should consider a higher internal risk rating if they host on cloud infrastructure where metadata is particularly sensitive.

Frequently asked questions