WordPress Plugin Vulnerabilities

Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

Description

The plugin does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

Proof of Concept

Affects Plugins

Plugin icon
import-users-from-csv-with-meta
Fixed in 2.4.5

References

CVE
CVE-2026-16542

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Binesh Madharapu
Submitter
Binesh Madharapu
Verified
Yes
WPVDB ID
f57577b2-3031-433a-a3e1-758d12b244d1

Timeline

Publicly Published
2026-09-18 (about 2 days ago)
Added
2026-09-18 (about 1 day ago)
Last Updated
2026-09-18 (about 1 day ago)

Other

Published
Title
Published
2026-02-08
Title
Fluent Forms Pro Add On Pack < 6.1.13 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'
Published
2019-09-28
Title
Visualizer < 3.3.1 - Blind Server-Side Request Forgery (SSRF)
Published
2025-01-21
Title
AI Power: Complete AI Pack < 1.8.97 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2024-03-01
Title
Image Optimizer, Resizer and CDN – Sirv < 7.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2023-05-30
Title
Download Monitor < 4.8.2 - Admin+ SSRF