CVE-2025-14627: 
WordPress vulnerability analysis and mitigation

CVE-2025-14627 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Import – Ultimate CSV XML Importer plugin for WordPress, affecting all versions up to and including 7.35. The flaw allows authenticated attackers with Contributor-level access or higher to make the server perform HTTP requests to arbitrary internal endpoints, including localhost, private IP ranges, and cloud metadata services such as 169.254.169.254. It was published on January 1, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-918 (Server-Side Request Forgery). The vulnerability exists in the upload_function() method, which validates the initial user-supplied URL using WordPress's wp_http_validate_url(). However, when a Bitly shortlink is detected, the unshorten_bitly_url() function follows the redirect chain to the final destination URL without re-validating it against the same allowlist. This open-redirect bypass allows an attacker to supply a Bitly shortlink that resolves to an internal or restricted address (e.g., http://169.254.169.254/latest/meta-data/) that would otherwise be blocked (Red Hat CVE, Feedly).

Successful exploitation allows an authenticated contributor to pivot the WordPress server into a proxy for internal network reconnaissance. Sensitive data exposed may include cloud instance metadata (AWS/GCP/Azure credentials, IAM roles), internal service responses from private IP ranges, and localhost-bound administrative interfaces. While availability is not directly impacted, the confidentiality and integrity impacts are rated Low each in a Changed scope, meaning resources beyond the plugin itself can be affected — particularly in cloud-hosted environments where metadata services expose credentials enabling further lateral movement (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of writing. The EPSS score is 0.026%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level WordPress authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Feedly).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running WP Import plugin ≤ 7.35.
2. Create a Bitly Shortlink: Using a Bitly account, create a shortened URL that redirects to a target internal address, such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata endpoint).
3. Trigger the Import Function: Navigate to the WP Import plugin's upload/import interface and supply the crafted Bitly shortlink as the remote URL for import.
4. Bypass Validation: The plugin validates the Bitly URL via wp_http_validate_url() (which passes), then calls unshorten_bitly_url() to follow the redirect to the internal endpoint without re-validation.
5. Retrieve Internal Data: The server fetches the internal endpoint and may return the response (e.g., cloud credentials, internal service data) to the attacker through the plugin's response or error output (Red Hat CVE, Feedly).

• Network: Outbound HTTP requests from the WordPress server to 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 address ranges; outbound requests to bit.ly or other URL shortener domains originating from the web server process.
• Logs: Web server or PHP error logs showing HTTP requests initiated by the WP Import plugin (upload_function) to internal or metadata IP addresses; access logs showing Contributor-level users repeatedly accessing the plugin's import endpoint.
• Process: Unusual outbound connections from the PHP-FPM or Apache/Nginx worker process to non-standard internal IPs or cloud metadata services.

Users should update the WP Import – Ultimate CSV XML Importer plugin to a version beyond 7.35 that addresses this vulnerability. As a workaround, site administrators can restrict Contributor-level user permissions to prevent access to the plugin's import functionality, or implement a Web Application Firewall (WAF) rule to block outbound server-side requests to private IP ranges and metadata service addresses. Cloud-hosted WordPress instances should additionally enforce IMDSv2 (on AWS) or equivalent metadata service hardening to limit the impact of SSRF exploitation (Red Hat CVE).

The vulnerability received routine coverage from vulnerability aggregation platforms including Vulners, VulDB, CVEFeed, and CIRCL's vulnerability lookup service shortly after disclosure. INCIBE-CERT (Spain's national cybersecurity agency) and ENISA's EUVD catalog (EUVD-2026-0012) also indexed the advisory. No notable researcher commentary, vendor blog posts, or significant social media discussion beyond automated CVE tracking has been observed (Feedly).