CVE-2026-11397
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. After wp_safe_remote_get() fails (blocking private IPs), the plugin falls back to GuzzleHttp\Client::request() with no SSRF protection and disabled TLS verification. This allows authenticated attackers with administrator-level access to make requests to arbitrary internal services, such as cloud metadata endpoints.
Risk Assessment
The risk includes the ability to probe and modify data in internal services like cloud metadata endpoints (e.g., 169.254.169.254), potentially leading to sensitive information disclosure or privilege escalation in cloud environments.
Recommendation
Immediately update the WP Import Export Lite plugin to the latest available version that addresses this vulnerability. As a temporary measure, restrict plugin access to trusted administrators and implement WAF rules to block suspicious URL requests.
Other vulnerabilities in WP Import Export Lite
See all- CVE-2026-76559Low risk· EPSS 7%
The WP Import Export Lite plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with import capability (administrators by default) to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.
- CVE-2026-76558Low risk· EPSS 10%
The WP Import Export Lite plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
- CVE-2026-76557Low risk· EPSS 11%
The WP Import Export Lite plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the import permission to perform SQL injection attacks.
- CVE-2026-76556Low risk· EPSS 11%
The WP Import Export Lite plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission (administrators by default, may also grant to lower roles) to perform SQL injection attacks.
- CVE-2026-76555Low risk· EPSS 9%
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing users with import permission to disclose sensitive files from the server, including files outside the web root. The same code path also relaxes file-system permissions of any path it is given, whether or not the copy succeeds.
- CVE-2026-76553Low risk· EPSS 8%
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a capability to delete arbitrary directories and every file within them, including outside the web root.
- CVE-2026-76552Low risk· EPSS 17%
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
- CVE-2026-76551Low risk· EPSS 20%
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.
- CVE-2026-76550Low risk· EPSS 20%
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.
Original NVD description (English source)
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. The plugin's URL downloader first calls wp_safe_remote_get() (which correctly blocks private/reserved IP ranges), but when that call returns a WP_Error — the exact outcome for any blocked internal host — the Download::download_file() method falls back to GuzzleHttp\Client::request() with the original attacker-supplied URL and no SSRF protection (and with TLS verification disabled). This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services such as the cloud metadata endpoint at 169.