CVE-2026-11397: WP Import Export Lite SSRF Vulnerability

CVE-2026-11397 Overview

CVE-2026-11397 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Import Export Lite plugin for WordPress. The flaw affects all versions up to and including 3.9.30 and is reachable through the wpie_import_upload_file_from_url AJAX action. Authenticated attackers with administrator-level access or above can force the server to issue arbitrary HTTP requests to internal resources. The vulnerability is tracked under [CWE-918]: Server-Side Request Forgery.

Critical Impact
Authenticated administrators can pivot from the WordPress host to internal-only services, including cloud instance metadata endpoints such as 169.254.169.254, enabling potential credential theft and lateral movement.

Affected Products

WP Import Export Lite plugin for WordPress, all versions through 3.9.30
WordPress sites exposing the wpie_import_upload_file_from_url AJAX action
Cloud-hosted WordPress deployments that expose instance metadata services (AWS, Azure, GCP)

Discovery Timeline

2026-07-03 - CVE-2026-11397 published to the National Vulnerability Database
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-11397

Vulnerability Analysis

The WP Import Export Lite plugin exposes a URL-based file import feature that downloads content from an attacker-supplied URL. The download routine first attempts to fetch the URL using wp_safe_remote_get(), which correctly blocks private and reserved IP ranges. When the safe request fails, the plugin does not treat the failure as a security decision. Instead, it treats it as a transport error and retries the request through a different HTTP client.

The retry path in Download::download_file() calls GuzzleHttp\Client::request() with the original attacker-supplied URL. This second client applies no SSRF filtering and disables TLS certificate verification. Any URL blocked by the first call proceeds unimpeded through the second. Attackers can reach loopback services, RFC1918 networks, link-local addresses, and cloud metadata endpoints at 169.254.169.254.

Root Cause

The root cause is a fail-open error-handling pattern. The plugin interprets the WP_Error returned by wp_safe_remote_get() — which is the exact outcome when the target host is blocked for safety — as a signal to retry with an unrestricted HTTP client. The fallback removes the very control designed to prevent SSRF and simultaneously disables TLS verification, weakening confidentiality on outbound traffic.

Attack Vector

Exploitation requires an authenticated session with administrator privileges. The attacker invokes the wpie_import_upload_file_from_url AJAX action and supplies a URL pointing at an internal address, such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. The first HTTP client rejects the request, then the Guzzle-based fallback issues it, and response content is available to the attacker through the import workflow. Refer to the Wordfence Vulnerability Report and the plugin source at download.php line 97 for the vulnerable code path.

Detection Methods for CVE-2026-11397

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP worker to 169.254.169.254, 127.0.0.1, or RFC1918 addresses
POST requests to admin-ajax.php with the action=wpie_import_upload_file_from_url parameter carrying non-public URLs
Guzzle User-Agent strings originating from the web server that were not present in prior baselines
Web server error logs containing WP_Error entries followed by successful outbound fetches for the same URL

Detection Strategies

Inspect web access logs for admin-ajax.php calls invoking wpie_import_upload_file_from_url and correlate with the source URL parameter
Alert on any outbound connection from web application processes to instance metadata IPs or loopback ranges
Review WordPress audit logs for administrator accounts using the import feature outside of expected change windows

Monitoring Recommendations

Enable egress network policies at the host or cloud level and log every denied outbound flow from web tiers
Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS and equivalent hardening on Azure and GCP, then monitor for legacy IMDSv1 requests
Ingest WordPress and PHP logs into a centralized log platform and build queries around the wpie_import_upload_file_from_url action name

How to Mitigate CVE-2026-11397

Immediate Actions Required

Update WP Import Export Lite to a version later than 3.9.30 as soon as the vendor publishes a fixed release
Audit administrator accounts on affected WordPress sites and remove or reduce unused privileged users
Rotate any cloud credentials that were retrievable from the instance metadata service on hosts running the plugin

Patch Information

At the time of publication, the NVD entry does not list a fixed version. Review the WordPress plugin trunk commit and the Wordfence Vulnerability Report for the latest fix status. Apply the vendor patch as soon as it is available.

Workarounds

Disable or uninstall the WP Import Export Lite plugin until a patched release is deployed
Block outbound traffic from the WordPress host to 169.254.169.254 and to internal management subnets using host firewall rules or cloud security groups
Restrict access to admin-ajax.php administrator-only actions through a web application firewall rule that inspects the action parameter
Require IMDSv2 with hop-limit 1 on AWS instances to prevent SSRF from reaching credentials

bash

# Example AWS CLI command to enforce IMDSv2 on an EC2 instance
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled