Ddadd

**Name of the Vulnerable Software and Affected Versions** WP Import Export Lite versions prior to 3.9.31 **Description** An issue exists in the `wpie import upload file from url` AJAX action. The plugin initially uses `wp safe remote get()` to download files, which blocks private IP ranges. However, if this call returns a `WP Error`, the `Download::download file()` method falls back to `GuzzleHttpClient::request()` using the original user-supplied URL without SSRF protection and with TLS verification disabled. This allows authenticated attackers with administrator-level access to perform Server-Side Request Forgery (SSRF), enabling them to make web requests to arbitrary locations from the server, such as querying or modifying information from internal services like the cloud metadata endpoint at 169. **Recommendations** Update the plugin to a version newer than 3.9.30. As a temporary workaround, restrict administrator-level access to the `wpie import upload file from url` AJAX action.