The Advanced Import plugin for WordPress allows authenticated users with Author-level or higher permissions to trigger server‑side requests by submitting the demo_file form field. The plugin uses wp_remote_get without validating the user‑supplied URL, enabling the attacker to instruct the WordPress installation to fetch any internal or external resource. This can be used to exfiltrate data from internal services or access cloud instance metadata endpoints, potentially leaking secrets or sensitive configuration information. The vulnerability is a classic instance of CWE‑918, which can compromise confidentiality by exposing internal network details and may affect availability if malicious requests overwhelm services.

The affected product is the Advanced Import WordPress plugin, version 1.4.6 and all earlier releases. Users operating any of these plugin versions on WordPress sites should assess whether their site grants upload_files capability to users with Author or higher roles.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score is not available, so the estimated likelihood of exploitation is unknown, but because the flaw allows denial of service and data theft from internal resources, it warrants prompt attention. The vulnerability is not listed in the CISA KEV catalog, yet authenticated attackers can still exploit it if they have access to the site. The plausible attack vector is through the plugin’s AJAX handler when a user performs the One‑Click Demo Import action with a malicious demo_file URL.