CVE-2025-14627: WP Import Plugin SSRF Vulnerability

CVE-2025-14627 Overview

The WP Import – Ultimate CSV XML Importer for WordPress plugin is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to, and including, 7.35. This vulnerability arises from inadequate validation of resolved URLs after following Bitly shortlink redirects in the upload_function() method. While the initial URL undergoes validation using wp_http_validate_url(), when a Bitly shortlink is detected, the unshorten_bitly_url() function follows redirects to the final destination URL without re-validating it against security policies.

Critical Impact

Authenticated attackers with Contributor-level access or higher can force the server to make HTTP requests to arbitrary internal endpoints, including localhost, private IP ranges, and cloud metadata services (e.g., 169.254.169.254), potentially exposing sensitive internal data and cloud credentials.

Affected Products

• WP Import – Ultimate CSV XML Importer for WordPress versions up to and including 7.35
• WordPress installations utilizing the vulnerable plugin versions
• Cloud-hosted WordPress environments with accessible metadata services

Discovery Timeline

• 2026-01-01 - CVE CVE-2025-14627 published to NVD
• 2026-01-02 - Last updated in NVD database

Technical Details for CVE-2025-14627

Vulnerability Analysis

This Server-Side Request Forgery vulnerability exists in the URL upload functionality of the WP Import plugin. The core issue lies in the validation bypass mechanism that occurs when processing Bitly shortlinks. The plugin implements URL validation using WordPress's wp_http_validate_url() function to prevent SSRF attacks by blocking requests to internal IP addresses and restricted endpoints. However, when the plugin detects a Bitly shortlink, it follows the redirect chain to determine the final destination URL through the unshorten_bitly_url() function without applying the same validation checks to the resolved URL.

This creates a Time-of-Check Time-of-Use (TOCTOU) style vulnerability where the security validation is performed on the initial input (the Bitly URL), but the actual request is made to a different URL (the redirect destination) that may point to sensitive internal resources.

Root Cause

The root cause is the inconsistent application of URL validation in the UrlUpload.php file. The upload_function() method at line 73 performs initial validation, but when processing Bitly shortlinks, the unshorten_bitly_url() function at line 290 resolves redirects without re-applying wp_http_validate_url() to the final destination. This allows attackers to craft a Bitly shortlink that redirects to internal resources, effectively bypassing the SSRF protections.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which describes scenarios where web applications make requests to user-supplied URLs without adequate validation, allowing attackers to coerce the application into sending requests to unexpected destinations.

Attack Vector

The attack requires network access and authenticated access with at least Contributor-level privileges to the WordPress installation. An attacker can exploit this vulnerability by:

1. Creating a Bitly shortlink that redirects to an internal endpoint (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata)
2. Submitting this shortlink through the plugin's URL import functionality
3. The plugin validates the Bitly URL (which passes validation as it's external)
4. The plugin then follows the redirect to the internal endpoint without validation
5. The server makes the request and returns the response, exposing internal data

The vulnerability can be exploited to access cloud metadata services to steal IAM credentials, probe internal network services and infrastructure, access internal APIs and administrative interfaces, and enumerate internal network topology.

Detection Methods for CVE-2025-14627

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• HTTP requests to cloud metadata endpoints (169.254.169.254) originating from the web application
• Access logs showing requests to the WP Import plugin's upload functionality with Bitly URLs followed by internal resource access attempts
• Unexpected data exfiltration or credential usage following import operations

Detection Strategies

• Monitor web application firewall (WAF) logs for requests containing Bitly shortlinks to the CSV/XML import endpoints
• Implement network-level monitoring for connections from web servers to RFC 1918 private IP addresses or link-local addresses
• Review WordPress access logs for suspicious activity patterns from users with Contributor or higher roles using the import functionality
• Deploy cloud-native security tools to detect unusual metadata service access patterns

Monitoring Recommendations

• Enable detailed logging for the WP Import plugin's upload operations and URL resolution processes
• Configure alerts for any server-initiated requests to cloud metadata endpoints (169.254.169.254)
• Implement network segmentation monitoring to detect lateral movement attempts from web application servers
• Set up behavioral baselines for WordPress server outbound connections and alert on anomalies

How to Mitigate CVE-2025-14627

Immediate Actions Required

• Update the WP Import – Ultimate CSV XML Importer plugin to the latest patched version (above 7.35)
• Review WordPress user accounts and restrict Contributor-level access to trusted users only
• Audit recent import operations for any suspicious URL submissions containing shortlinks
• Implement network-level controls to block outbound requests from web servers to internal IP ranges and cloud metadata services

Patch Information

The vulnerability has been addressed in versions after 7.35. The WordPress Plugin Changeset contains the security fix that adds proper validation of URLs after resolving shortlink redirects. Administrators should update to the latest version through the WordPress plugin update mechanism.

For additional technical details, refer to the Wordfence Vulnerability Report and the vulnerable code at UrlUpload.php line 73 and line 290.

Workarounds

• Temporarily disable the WP Import – Ultimate CSV XML Importer plugin until patching is complete
• Implement WAF rules to block requests containing Bitly shortlinks to the plugin's import endpoints
• Configure Instance Metadata Service version 2 (IMDSv2) on AWS to require session tokens, mitigating metadata theft
• Apply network-level egress filtering to prevent the WordPress server from connecting to internal IP ranges and metadata services

# Example: Block metadata service access using iptables on Linux
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Example: AWS IMDSv2 enforcement via AWS CLI
aws ec2 modify-instance-metadata-options \
    --instance-id i-1234567890abcdef0 \
    --http-tokens required \
    --http-endpoint enabled