CVE-2024-9624: WP All Import Pro SSRF Vulnerability

CVE-2024-9624 Overview

CVE-2024-9624 is a Server-Side Request Forgery (SSRF) vulnerability in the WP All Import Pro plugin for WordPress. The flaw affects all versions up to and including 4.9.3. The root cause is missing SSRF protection in the pmxi_curl_download function. Authenticated attackers with Administrator-level access can force the WordPress server to issue arbitrary web requests. These requests originate from the web application and can reach internal services that are otherwise unreachable from the internet. On cloud platforms, attackers can query instance metadata endpoints to retrieve credentials, tokens, or configuration data. The vulnerability is tracked under CWE-918.

Critical Impact
Authenticated administrators can pivot through the WordPress server to internal networks and cloud metadata services, enabling credential theft and lateral movement.

Affected Products

WP All Import Pro plugin for WordPress, versions up to and including 4.9.3
WordPress sites using the pmxi_curl_download function
Cloud-hosted WordPress deployments exposing instance metadata services (AWS, Azure, GCP)

Discovery Timeline

2024-12-17 - CVE-2024-9624 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-9624

Vulnerability Analysis

The vulnerability resides in the pmxi_curl_download function of the WP All Import Pro plugin. This function is designed to fetch remote files for import operations. It accepts a URL parameter and issues an outbound request using cURL. The implementation does not validate the destination host, scheme, or IP address before issuing the request.

An authenticated administrator can supply a URL pointing to internal resources. Valid targets include private IP ranges such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, along with loopback addresses like 127.0.0.1. Attackers can also target the cloud metadata endpoint at http://169.254.169.254/ to retrieve temporary IAM credentials on AWS or equivalent tokens on other providers.

Root Cause

The download function lacks host allowlisting, scheme validation, and IP address filtering. It trusts the URL supplied by the authenticated user without normalizing it or resolving DNS names to check against restricted ranges. This maps directly to CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires Administrator privileges on the WordPress site. The attacker submits an import operation that references a crafted URL. The plugin dispatches the request from the server context, returning response data or side effects to the attacker. Because the response body may be rendered in the admin interface, attackers can exfiltrate metadata contents directly. The SSRF also enables interaction with internal APIs, databases exposing HTTP interfaces, and administrative panels bound to localhost.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-9624

Indicators of Compromise

Outbound HTTP requests from the WordPress host to 169.254.169.254 or other link-local addresses
Unexpected cURL requests to RFC1918 private IP ranges originating from the PHP worker process
Import job logs referencing URLs that point to localhost, 127.0.0.1, or internal hostnames
Access to cloud IAM credential endpoints followed by anomalous API calls using those credentials

Detection Strategies

Inspect WordPress wp_options and import history tables for entries referencing internal or metadata URLs
Monitor egress network logs for connections from web servers to metadata IPs and private ranges
Correlate administrator login events with subsequent outbound requests initiated by the PHP process

Monitoring Recommendations

Enable audit logging on the WordPress admin panel to track import configuration changes
Deploy egress filtering rules that block server-originated traffic to 169.254.169.254 and RFC1918 destinations unless explicitly required
Alert on cURL user-agent strings hitting cloud metadata endpoints from application servers

How to Mitigate CVE-2024-9624

Immediate Actions Required

Update WP All Import Pro to a version later than 4.9.3 as released by the vendor
Audit WordPress administrator accounts and remove unused or excessive privileges
Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS to require session tokens for metadata access
Restrict outbound network access from WordPress hosts to only required destinations

Patch Information

The vendor addresses the issue in releases after 4.9.3 by adding SSRF protections to the pmxi_curl_download function. Refer to the WP All Import site for the current release and the Wordfence advisory for patch verification details.

Workarounds

Block outbound requests from the web server to 169.254.169.254, 127.0.0.0/8, and RFC1918 ranges at the firewall or host level
Disable the WP All Import Pro plugin until the update can be applied
Limit Administrator role assignment and require multi-factor authentication for all admin accounts
Deploy a Web Application Firewall (WAF) rule to inspect import URLs submitted through the plugin

bash

# Example iptables rule to block metadata access from the web server
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -m owner --uid-owner www-data -j DROP