WordPress Plugin Vulnerabilities

WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

Description

The plugin does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.

Proof of Concept

Affects Plugins

Plugin icon
wp-import-export-lite
Fixed in 3.9.33

References

CVE
CVE-2026-76559

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Yassin Mohamed
Submitter
Yassin Mohamed
Verified
Yes
WPVDB ID
62e27c51-95c7-407b-81aa-85757130adb9

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2025-06-19
Title
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor < 1.27.9 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2026-07-27
Title
FormCraft < 3.9.16 - Unauthenticated Server-Side Request Forgery
Published
2025-10-22
Title
MxChat – AI Chatbot for WordPress < 2.4.7 - Unauthenticated Blind Server-Side Request Forgery
Published
2026-07-25
Title
Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id
Published
2024-04-16
Title
Really Simple SSL < 8.0.0 - Admin+ Server-Side Request Forgery