CVE-2026-16542: WordPress SSRF Vulnerability in Plugin

CVE-2026-16542 Overview

CVE-2026-16542 is a Server-Side Request Forgery (SSRF) vulnerability in the Import and export users and customers WordPress plugin before version 2.4.5. The plugin fails to validate a user-supplied URL before requesting it server-side during a CSV import operation. High-privileged users can abuse this behavior to force the WordPress server to issue arbitrary HTTP requests. The flaw is categorized under [CWE-918] Server-Side Request Forgery.

Critical Impact
Authenticated high-privileged users can coerce the WordPress host to send requests to internal network resources, potentially exposing internal services, cloud metadata endpoints, and non-public HTTP interfaces.

Affected Products

Import and export users and customers WordPress plugin versions prior to 2.4.5
WordPress sites running the affected plugin with high-privileged user accounts enabled
Environments where the WordPress host has network access to internal or cloud metadata services

Discovery Timeline

2026-09-20 - CVE-2026-16542 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-16542

Vulnerability Analysis

The vulnerability resides in the CSV import functionality of the Import and export users and customers plugin. During an import, the plugin accepts a URL from the user and fetches its contents server-side to parse CSV data. The plugin performs this outbound request without validating the destination host, scheme, or IP address. An authenticated attacker with high privileges can supply a URL pointing to internal endpoints such as http://127.0.0.1, http://169.254.169.254 (cloud instance metadata), or other RFC1918 addresses.

Because the request originates from the WordPress server, it bypasses network-perimeter controls that would ordinarily block direct external access to internal services. The response contents or timing side channels may leak information back to the attacker through import error messages or behavior.

Root Cause

The root cause is missing URL validation and allow-listing prior to invoking the HTTP client. The plugin trusts the URL parameter provided in the import request and does not enforce restrictions on the destination scheme, hostname resolution, or address ranges. This corresponds to CWE-918 (Server-Side Request Forgery).

Attack Vector

Exploitation requires an authenticated session with high-privileged access, typically an administrator role capable of running the import feature. The attacker navigates to the CSV import interface, submits a crafted URL targeting an internal resource, and triggers the server-side fetch. Impact scope is Changed per the CVSS vector, reflecting that the SSRF crosses a trust boundary from the WordPress application into adjacent internal network services. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-16542

Indicators of Compromise

Outbound HTTP requests from the WordPress host to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) originating from the PHP process
Requests to cloud metadata endpoints such as 169.254.169.254 from the WordPress web server
CSV import audit log entries containing non-standard URL schemes or unexpected hostnames

Detection Strategies

Inspect WordPress request logs for POST requests to the plugin's import endpoint containing URL parameters pointing to internal or metadata addresses
Correlate administrative user activity with outbound network connections initiated by the PHP-FPM or web server process
Alert on any plugin-initiated HTTP client calls that resolve to private or link-local IP ranges

Monitoring Recommendations

Enable verbose logging on the WordPress plugin activity and forward it to a centralized log platform for correlation
Monitor egress traffic from web application servers and flag connections destined for internal service ports (for example, 6379, 9200, 2375)
Track privileged account usage patterns and alert on first-time use of the import functionality by administrators

How to Mitigate CVE-2026-16542

Immediate Actions Required

Update the Import and export users and customers WordPress plugin to version 2.4.5 or later
Audit administrator and high-privileged user accounts for unexpected activity in the import functionality
Restrict egress network access from the WordPress host to only required destinations

Patch Information

The vendor addressed the issue in version 2.4.5 of the plugin by adding URL validation before performing server-side requests. Refer to the WPScan Vulnerability Report for advisory details and upgrade guidance.

Workarounds

Temporarily disable the Import and export users and customers plugin until it is patched
Apply egress firewall rules blocking outbound requests from the WordPress server to private address ranges and cloud metadata endpoints
Limit administrator account provisioning and enforce multi-factor authentication for high-privileged users

bash

# Example egress restriction using iptables to block metadata endpoint
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 ! -o lo -j REJECT