The WP Import Export Lite plugin for WordPress contains a Server‑Side Request Forgery (SSRF) flaw (CWE‑918) that is exercised by the wpie_import_upload_file_from_url AJAX action. When wp_safe_remote_get is invoked with a URL that points to a private or reserved IP the request returns a WP_Error. The plugin then falls back to a raw GuzzleHttp client call that omits all SSRF checks and disables TLS verification, allowing the attacker‑supplied URL to be fetched without restriction. An authenticated administrator can therefore make HTTP requests to arbitrary internal or external services from the web server. The flaw can be used to access sensitive hosts such as cloud metadata endpoints or to manipulate data on internal networks.

The flaw affects all WordPress sites that have the WP Import Export Lite plugin by Vjinfotech installed 3.9.30 or earlier. No other vendors or product versions are listed, so the impact is limited to this specific plugin and its vulnerable releases.

The severity of the vulnerability is represented by a CVSS score of 5.5, placing it in the medium range. The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation in the general population, and the vulnerability is not included in the CISA KEV catalog. Exploitation requires authenticated administrator access, so the scope of risk is confined to sites with privileged users. Once authenticated, an attacker can use the SSRF vector to query or modify internal services, but widespread exploitation is unlikely without administrative credentials.