WP Import Export Lite Authenticated SSRF via file_url (CVE-2026-11397)

Vulnerability Overview Vulnerability Name: WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter CVE ID: CVE-2026-11397 CVSS Score: 5.5 (Medium) Published Date: July 2, 2026 Last Updated: July 3, 2026 Researcher: 00ADDA Affected Versions Affected Versions: WP Import Export Lite <= 3.9.30 Vulnerability Type: Server-Side Request Forgery (SSRF) Description: The WP Import Export Lite plugin contains an SSRF vulnerability in version 3.9.30 and earlier. The plugin's URL downloader initially calls (which correctly blocks private/reserved IP ranges). However, when the call returns a (i.e., for any blocked internal host), the method falls back to (using the attacker-supplied URL without SSRF protection, including disabling TLS verification). This allows an authenticated attacker with Administrator-level access to make web requests originating from the web application to arbitrary destinations, which can be used to query and modify information from internal services, such as cloud metadata endpoints. Remediation Fixed Version: Update to 3.9.31 or later Patch Status: Fixed Additional Information Software Type: Plugin Software Slug: wp-import-export-lite References: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload - CVE ID: CVE-2025-5061 - CVSS Score: 7.5 - Researchers: Vincent Fourcade (vinceMatsu), Mathys, Jérôme Gaudin - Published Date: August 4, 2025 WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload - CVE ID: CVE-2025-6207 - CVSS Score: 7.5 - Researchers: Vincent Fourcade (vinceMatsu), Mathys, Jérôme Gaudin - Published Date: August 4, 2025 WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting - CVE ID: CVE-2025-2839 - CVSS Score: 6.4 - Researchers: Webbernaut - Published Date: April 21, 2025 WP Import Export Lite <= 3.9.26 - Authenticated (Administrator+) PHP Object Injection - CVE ID: CVE-2024-31308 - CVSS Score: 7.2 - Researchers: Trinh Vũ - Published Date: May 4, 2024 WP Import Export Lite & WP Import Export <= 3.9.15 - Unauthenticated Sensitive Data Disclosure - CVE ID: CVE-2022-0236 - CVSS Score: 7.5 - Researchers: Karan Saini - Published Date: January 14, 2022 Summary The WP Import Export Lite plugin contains an SSRF vulnerability in versions 3.9.30 and earlier, which attackers can exploit for server-side request forgery. Users are advised to update to version 3.9.31 or later as soon as possible to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WP Import Export Lite Authenticated SSRF via file_url (CVE-2026-11397)