Description

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-09-20T07:16:49.467Z",
  "pubdate": "2026-09-20T07:16:49.467Z",
  "executiveSummary": "The 'Import and export users and customers' WordPress plugin prior to version 2.4.5 contains a Server-Side Request Forgery (SSRF) vulnerability. This flaw stems from the improper validation of user-supplied URLs during the CSV import process. By providing a malicious URL, a high-privileged user can force the web server to perform unauthorized HTTP requests to internal or external resources.\nThe impact includes potential reconnaissance of internal network infrastructure, interaction with services protected by the firewall, and the exfiltration of sensitive metadata or data reachable by the web server. Because the vulnerability is triggered by high-privileged users, it represents a significant escalation of authority, allowing a malicious administrator or user with import capabilities to bypass network segmentation and interact with services that are otherwise unreachable from the public internet. The risk is critical in environments where the web server has access to sensitive internal APIs or local metadata services, such as those found in cloud environments.",
  "technicalDetails": "The root cause of this SSRF vulnerability is the lack of server-side sanitization and whitelist-based validation for URLs processed during the plugin's CSV import feature. When a user uploads a CSV file containing an external URL, the plugin's backend logic attempts to fetch the content from the specified location without checking if the target destination resides within a restricted range (e.g., local host, internal IP address spaces, or unauthorized domains).\nThe exploitation flow begins with an authenticated user with sufficient privileges to access the import functionality. The attacker constructs a CSV file where one of the fields includes a URL pointing to an internal target or a controlled external endpoint. Upon submitting this file for import, the plugin processes the CSV, extracts the URL, and invokes an internal request method. Because the plugin performs this request server-side, the resulting traffic originates from the web server itself.\nIn a typical attack scenario, an adversary could target internal services such as the local database management interface, cloud instance metadata services (e.g., 169.254.169.254), or internal microservices that assume trust based on the originating IP address. By observing the response times or error messages returned by the plugin during the import process, an attacker can perform blind SSRF or read back data if the plugin displays the result of the fetch. This effectively enables the attacker to probe the internal network topology, test for reachable services, and extract sensitive information like cloud provider credentials or internal configuration data.\nThis vulnerability specifically affects all versions of 'Import and export users and customers' prior to 2.4.5. Successful exploitation requires an active session with high-privilege credentials, such as an administrator account. The network exposure is limited to the server hosting the WordPress installation; however, the impact is magnified by the server's position within the infrastructure, as it acts as a pivot point for further lateral movement or unauthorized data access. The vulnerability persists because the plugin fails to implement a strict URL validation mechanism, such as using a whitelist of allowed hostnames or protocols, and does not perform DNS resolution checks to prevent access to loopback or private IP ranges."
}