PT-2026-1010 · WordPress · Wp Import – Ultimate Csv Xml Importer

Dieu Link + 1 · Publicado 2026-01-01 · Atualizado 2026-01-01 · CVE-2025-14627

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Import – Ultimate CSV XML Importer for WordPress versions prior to 7.36

Description The plugin is susceptible to Server-Side Request Forgery (SSRF). This occurs because the plugin does not properly validate URLs after following Bitly shortlink redirects within the upload function() method. Specifically, the unshorten bitly url() function follows redirects without re-validating the final destination URL, allowing attackers to potentially make the server perform HTTP requests to arbitrary internal endpoints. This could include access to localhost, private IP ranges, and cloud metadata services. An authenticated attacker with Contributor-level access or higher can exploit this issue.

Recommendations Update to version 7.36 or later.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2025-14627

Produtos afetados

Wp Import – Ultimate Csv Xml Importer

Referências · 8

• https://twitter.com/CVEnew/status/2006861504692232459 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14627 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/87040f2b-4de0-4a8d-ae30-b340638a6df2?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3421699/wp-ultimate-csv-importer/trunk/uploadModules/UrlUpload.php · Nota
• https://t.me/cveNotify/147439 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L290 · Nota
• https://t.me/CVEtracker/41177 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L73 · Nota