CVE-2026-76559 Overview
CVE-2026-76559 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Import Export Lite WordPress plugin. Versions before 3.9.33 fail to validate URLs supplied during the import process. Authenticated users holding the import capability, which administrators possess by default, can coerce the site into issuing HTTP requests to internal hosts and reading the responses. The flaw represents an incomplete fix for CVE-2026-11397, meaning prior remediation guidance did not fully close the attack surface. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated administrators can pivot a public WordPress instance into an internal network probe, exposing metadata endpoints, intranet services, and cloud instance credentials.
Affected Products
- WP Import Export Lite WordPress plugin, all versions before 3.9.33
- WordPress sites where administrators or roles with the import capability are exposed
- Sites previously patched only against CVE-2026-11397
Discovery Timeline
- 2026-09-16 - CVE-2026-76559 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-76559
Vulnerability Analysis
The plugin accepts a user-supplied URL during import operations and fetches the resource server-side without validating the destination. Because the request originates from the WordPress host, it bypasses network boundaries that normally isolate internal services from external clients. The response body is returned within the import workflow, giving the attacker the ability to read internal HTTP content.
This behavior enables classic SSRF outcomes: enumeration of internal IP ranges, interaction with unauthenticated intranet dashboards, and retrieval of cloud metadata such as AWS Instance Metadata Service (IMDS) responses. Since the fix is incomplete relative to CVE-2026-11397, the original validation logic likely blocks a narrow set of schemes or hostnames but misses variants such as DNS rebinding, redirect chains, or alternate IP encodings.
Root Cause
The root cause is missing or insufficient allow-list validation on the target URL parameter before the plugin dispatches the outbound request. The prior patch for CVE-2026-11397 addressed a subset of unsafe destinations but did not fully normalize URLs, resolve hostnames prior to comparison, or restrict private and link-local address ranges.
Attack Vector
Exploitation requires an authenticated session with the import capability. The attacker triggers an import job while supplying a crafted URL that points to an internal service, a cloud metadata endpoint, or a loopback interface. The plugin performs the request server-side and returns the response, allowing the attacker to read data that is not reachable from the public internet. Refer to the WPScan Vulnerability Advisory for technical specifics of the request flow.
Detection Methods for CVE-2026-76559
Indicators of Compromise
- Outbound HTTP requests from the WordPress PHP worker to RFC1918 addresses, 127.0.0.1, or 169.254.169.254
- Import job entries in the plugin logs referencing URLs with private, loopback, or metadata hostnames
- Unexpected DNS queries from the web server resolving internal hostnames during import operations
Detection Strategies
- Inspect web server and PHP-FPM access logs for POST requests to the plugin's import endpoints correlated with outbound connections to internal ranges
- Alert on any egress from the WordPress host to cloud metadata IPs, since legitimate application code should not require this access
- Review WordPress audit logs for import actions initiated by accounts that do not normally perform data imports
Monitoring Recommendations
- Enable egress network monitoring on WordPress hosts and baseline expected external destinations
- Forward WordPress and web server logs to a centralized analytics platform for correlation across import activity and outbound traffic
- Track plugin version inventory across managed WordPress sites and flag hosts running WP Import Export Lite below 3.9.33
How to Mitigate CVE-2026-76559
Immediate Actions Required
- Update WP Import Export Lite to version 3.9.33 or later on every WordPress instance
- Audit accounts that hold the import capability and remove it from roles that do not require it
- Restrict outbound network access from WordPress hosts to only the destinations required for normal operation
Patch Information
The vendor addressed the SSRF in WP Import Export Lite 3.9.33. Administrators should apply the update immediately, as the prior fix associated with CVE-2026-11397 does not fully block exploitation. See the WPScan Vulnerability Advisory for reference details.
Workarounds
- Temporarily deactivate WP Import Export Lite until the 3.9.33 update can be deployed
- Enforce IMDSv2 on AWS EC2 instances to require session tokens for metadata access
- Place the WordPress host behind an egress proxy that denies requests to private, loopback, and cloud metadata address ranges
- Limit the import capability to a small set of trusted administrative accounts and monitor their use
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
