Server-Side Request Forgery in Advanced Import Plugin for WordPress

CVE-2026-4328

What is CVE-2026-4328?

The Advanced Import plugin for WordPress is susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to inadequate validation of user-supplied URLs. The issue arises in the demo_download_and_unzip() function, where the plugin uses wp_remote_get() without proper URL validation, allowing authenticated users with Author-level access or higher to initiate web requests to arbitrary locations. This could lead to exposure of internal service data, including sensitive cloud instance metadata. The plugin contains a more secure wp_safe_remote_get() in other areas, but its absence in this AJAX handler presents a significant risk.

References