Server-Side Request Forgery Vulnerability in WP Import Plugin by WordPress

CVE-2025-14627

What is CVE-2025-14627?

The WP Import – Ultimate CSV XML Importer plugin for WordPress exposes a vulnerability allowing authenticated users with Contributor-level access or higher to exploit Server-Side Request Forgery. This occurs due to improper validation in the upload_function() method when handling Bitly shortlink redirects. Although the initial URL is validated, the final redirect URL is not checked, enabling attackers to initiate HTTP requests to arbitrary internal services. This can lead to the unauthorized exposure of sensitive data, including internal endpoints and cloud metadata.

References