CVE-2026-11397 is a Server-Side Request Forgery vulnerability in the WP Import Export Lite WordPress plugin affecting all versions up to 3.9.30. The vulnerability arises because the plugin's URL downloader initially uses wp_safe_remote_get(), which blocks requests to private or reserved IP ranges. However, if this call returns a WP_Error (as it does for blocked internal hosts), the plugin falls back to using GuzzleHttp\Client::request() with the original URL, lacking SSRF protections and disabling TLS verification. This fallback allows authenticated administrators to force the server to make arbitrary HTTP requests, potentially exposing or modifying data from internal services such as cloud metadata endpoints (e.g., 169.254.169.254).

An attacker with administrator-level access can exploit this vulnerability to make the server send arbitrary HTTP requests to internal or external systems. This can lead to unauthorized information disclosure or modification of internal services, including sensitive cloud metadata endpoints. The vulnerability has a CVSS score of 5.5 (medium severity), indicating a moderate impact with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity involving the wpie_import_upload_file_from_url AJAX action. Avoid exposing internal services that could be targeted via SSRF. Do not rely on the plugin's fallback URL downloader behavior as it lacks SSRF protections.