CVE-2024-9624 is a Server-Side Request Forgery vulnerability (CWE-918) affecting the WP All Import Pro WordPress plugin up to version 4.9.3. The issue arises from missing SSRF protections in the pmxi_curl_download function, enabling authenticated administrators to induce the server to send crafted HTTP requests to arbitrary internal or external locations. This can be leveraged to access or manipulate internal services and cloud instance metadata endpoints. The vulnerability requires high privileges (Administrator or above) and does not involve user interaction beyond authentication.

An attacker with Administrator-level access can exploit this SSRF vulnerability to make arbitrary HTTP requests from the server, potentially accessing sensitive internal resources or cloud instance metadata. This can lead to unauthorized information disclosure and limited modification of internal service data. The vulnerability does not affect availability but has high confidentiality impact and low integrity impact according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing internal services that could be accessed via SSRF.