CVE-2026-4328 is a Server-Side Request Forgery vulnerability in the addonspress Advanced Import WordPress plugin. The flaw exists in the demo_download_and_unzip() function, which uses wp_remote_get() to fetch a URL provided by the 'demo_file' POST parameter after sanitization with sanitize_text_field(). This sanitization does not prevent SSRF because it only addresses XSS concerns. Unlike other parts of the plugin that use wp_safe_remote_get() to mitigate SSRF, this AJAX handler does not, allowing authenticated users with upload_files capability (Author-level and above) to make arbitrary HTTP requests from the server. This can lead to unauthorized access to internal network resources and sensitive data such as cloud metadata endpoints. No patch or official remediation is currently confirmed.

An authenticated attacker with Author-level privileges or higher can exploit this vulnerability to make arbitrary HTTP requests from the server hosting the WordPress site. This can be used to access internal or private network resources that are otherwise inaccessible externally, including sensitive cloud instance metadata endpoints. The impact includes potential unauthorized disclosure of internal data and information leakage. The CVSS score is 6.4 (medium), reflecting the need for authentication and limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level and higher user capabilities to trusted users only. Monitor for updates from addonspress regarding an official fix. Avoid exposing sensitive internal services that could be accessed via SSRF. No official patch or workaround is currently documented.