CVE-2026-4328 is a Server-Side Request Forgery vulnerability in the addonspress Advanced Import WordPress plugin affecting all versions up to and including 1.4.6. The vulnerability arises from the demo_download_and_unzip() function using wp_remote_get() to fetch a URL supplied via the 'demo_file' POST parameter without validating that the URL does not point to internal or private network resources. Although wp_safe_remote_get() is used elsewhere in the plugin, it is not used in this AJAX handler, allowing authenticated users with Author-level privileges (upload_files capability) to make arbitrary HTTP requests from the server. This can be leveraged to access internal services, including cloud instance metadata endpoints, potentially exposing sensitive information.

An authenticated attacker with Author-level access or higher can exploit this vulnerability to perform SSRF attacks, allowing them to make arbitrary HTTP requests from the server hosting the WordPress site. This can lead to unauthorized access to internal network resources and sensitive data, such as cloud instance metadata, which may facilitate further attacks or data leakage. The CVSS score of 6.4 reflects a medium severity impact with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user capabilities if possible and monitor for suspicious activity. Avoid using the affected plugin versions (<=1.4.6) or disable the plugin if not needed. Follow the vendor advisory for updates on patches or official fixes.