CVE-2026-11397 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Import Export Lite plugin for WordPress, affecting all versions up to and including 3.9.30. The vulnerability arises because the plugin first attempts to download a URL using wp_safe_remote_get(), which blocks private and reserved IP ranges. However, if this call fails and returns a WP_Error (as it does for blocked internal hosts), the plugin falls back to using GuzzleHttp\Client::request() with the original attacker-supplied URL. This fallback does not implement SSRF protections and disables TLS verification, allowing authenticated attackers with administrator privileges to make arbitrary HTTP requests from the server. This can be leveraged to query or modify internal services, including sensitive endpoints like cloud metadata services.

An authenticated attacker with administrator-level access can exploit this vulnerability to make arbitrary HTTP requests from the web server to internal or external systems. This can lead to unauthorized information disclosure or modification of internal services that are otherwise inaccessible externally, such as cloud metadata endpoints. The vulnerability has a CVSS 3.1 base score of 5.5 (medium severity), indicating a moderate impact on confidentiality and integrity without affecting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the wpie_import_upload_file_from_url AJAX action. Avoid using the vulnerable plugin version in sensitive environments. Follow vendor communications for updates on official fixes or temporary mitigations.