The vulnerability resides in the WP Import – Ultimate CSV XML Importer plugin, where authenticated users with Contributor-level access can cause the server to resolve a Bitly shortlink and subsequently follow redirects to an unvalidated URL. The plugin performs initial validation on the supplied URL, but after detecting a Bitly link it calls a function that automatically follows redirects without re‑validating the final destination. This allows the attacker to force the server to issue outbound HTTP requests to arbitrary internal addresses, including localhost, private IP ranges, or cloud metadata services, potentially leaking sensitive data and exposing internal resources.

This flaw affects any WordPress site running the WP Ultimate CSV Importer plugin version 7.35 or earlier, which takes its origin from the plugin maintainer smackcoders. Sites that have enabled the import feature for users with Contributor or higher roles are vulnerable. No specific operating system or server configurations are listed, but the issue applies wherever the plugin is installed and accessible to those roles.

The CVSS score of 6.4 classifies this as a medium risk vulnerability. The EPSS score of less than 1% indicates a very low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with Contributor or higher privilege and the ability to trigger the import function. If exploited, it can lead to disclosure of internal information and potential lateral movement within the network, but it does not grant arbitrary code execution on the server.