PT-2026-1010 · WordPress · Wp Import – Ultimate Csv Xml Importer

Dieu Link + 1 · Published 2026-01-01 · Updated 2026-01-01 · CVE-2025-14627

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Import – Ultimate CSV XML Importer for WordPress versions prior to 7.36

Description The plugin is susceptible to Server-Side Request Forgery (SSRF). This occurs because the plugin does not properly validate URLs after following Bitly shortlink redirects within the upload function() method. Specifically, the unshorten bitly url() function follows redirects without re-validating the final destination URL, allowing attackers to potentially make the server perform HTTP requests to arbitrary internal endpoints. This could include access to localhost, private IP ranges, and cloud metadata services. An authenticated attacker with Contributor-level access or higher can exploit this issue.

Recommendations Update to version 7.36 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-14627

Affected Products

Wp Import – Ultimate Csv Xml Importer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14627 · Security Note
• https://twitter.com/CVEnew/status/2006861504692232459 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/87040f2b-4de0-4a8d-ae30-b340638a6df2?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3421699/wp-ultimate-csv-importer/trunk/uploadModules/UrlUpload.php · Note
• https://t.me/cveNotify/147439 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L290 · Note
• https://t.me/CVEtracker/41177 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L73 · Note