CVE-2025-14627

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14627", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-12T21:29:55.600Z", "datePublished": "2026-01-01T16:19:31.257Z", "dateUpdated": "2026-04-08T17:04:57.772Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:57.772Z"}, "affected": [{"vendor": "smackcoders", "product": "WP Ultimate CSV Importer \u2013 Import CSV, XML & Excel into WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.35", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after following Bitly shortlink redirects in the `upload_function()` method. While the initial URL is validated using `wp_http_validate_url()`, when a Bitly shortlink is detected, the `unshorten_bitly_url()` function follows redirects to the final destination URL without re-validating it. This makes it possible for authenticated attackers with Contributor-level access or higher to make the server perform HTTP requests to arbitrary internal endpoints, including localhost, private IP ranges, and cloud metadata services (e.g., 169.254.169.254), potentially exposing sensitive internal data."}], "title": "WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/87040f2b-4de0-4a8d-ae30-b340638a6df2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L73"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L290"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421699/wp-ultimate-csv-importer/trunk/uploadModules/UrlUpload.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dieu Link"}, {"lang": "en", "type": "finder", "value": "GCSC Vietnam"}], "timeline": [{"time": "2025-12-12T21:45:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-01T03:53:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-05T20:08:44.277376Z", "id": "CVE-2025-14627", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T20:08:58.181Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14627", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-05T20:08:44.277376Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T20:08:52.507Z"}}], "cna": {"title": "WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Dieu Link"}, {"lang": "en", "type": "finder", "value": "GCSC Vietnam"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "smackcoders", "product": "WP Ultimate CSV Importer \u2013 Import CSV, XML & Excel into WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.35"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T21:45:16.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-01T03:53:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/87040f2b-4de0-4a8d-ae30-b340638a6df2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L73"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L290"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421699/wp-ultimate-csv-importer/trunk/uploadModules/UrlUpload.php"}], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after following Bitly shortlink redirects in the `upload_function()` method. While the initial URL is validated using `wp_http_validate_url()`, when a Bitly shortlink is detected, the `unshorten_bitly_url()` function follows redirects to the final destination URL without re-validating it. This makes it possible for authenticated attackers with Contributor-level access or higher to make the server perform HTTP requests to arbitrary internal endpoints, including localhost, private IP ranges, and cloud metadata services (e.g., 169.254.169.254), potentially exposing sensitive internal data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:04:57.772Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14627", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:04:57.772Z", "dateReserved": "2025-12-12T21:29:55.600Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-01T16:19:31.257Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Ultimate CSV Importer \u2013 Import CSV, XML & Excel into WordPress", "vendor": "smackcoders", "versions": [{"lessThanOrEqual": "7.35", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Import \u2013 Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after following Bitly shortlink redirects in the `upload_function()` method. While the initial URL is validated using `wp_http_validate_url()`, when a Bitly shortlink is detected, the `unshorten_bitly_url()` function follows redirects to the final destination URL without re-validating it. This makes it possible for authenticated attackers with Contributor-level access or higher to make the server perform HTTP requests to arbitrary internal endpoints, including localhost, private IP ranges, and cloud metadata services (e.g., 169.254.169.254), potentially exposing sensitive internal data."}, {"lang": "es", "value": "El plugin WP Import \u2013 Ultimate CSV XML Importer para WordPress de WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 7.35, inclusive. Esto se debe a una validaci\u00f3n inadecuada de la URL resuelta despu\u00e9s de seguir redirecciones de enlaces cortos de Bitly en el m\u00e9todo 'upload_function()'. Si bien la URL inicial se valida usando 'wp_http_validate_url()', cuando se detecta un enlace corto de Bitly, la funci\u00f3n 'unshorten_bitly_url()' sigue las redirecciones a la URL de destino final sin volver a validarla. Esto hace posible que atacantes autenticados con acceso de nivel de Colaborador o superior hagan que el servidor realice peticiones HTTP a endpoints internos arbitrarios, incluyendo localhost, rangos de IP privados y servicios de metadatos en la nube (p. ej., 169.254.169.254), exponiendo potencialmente datos internos sensibles."}], "id": "CVE-2025-14627", "lastModified": "2026-06-17T08:36:17.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14627", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-05T20:08:44.277376Z", "version": "2.0.3"}}]}, "published": "2026-01-01T17:15:42.597", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L290"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L73"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3421699/wp-ultimate-csv-importer/trunk/uploadModules/UrlUpload.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/87040f2b-4de0-4a8d-ae30-b340638a6df2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:53:24.267358+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Ultimate CSV Importer plugin to version 7.36 or later, which contains the fixed validation logic.", "If an update is delayed, block outbound HTTP requests to Bitly domains and internal IP ranges through network controls or firewall rules to prevent the redirect resolution.", "Consider disabling the URL upload feature for non-administrative users until the patch is applied to reduce the attack surface.", "Monitor server logs for unexpected outbound HTTP requests originating from the plugin to detect attempted exploitation."], "summary": {"action": "Apply Patch", "impact": "Server-Side Request Forgery"}, "threat_synthesis": {"affected_systems": "This flaw affects any WordPress site running the WP Ultimate CSV Importer plugin version 7.35 or earlier, which takes its origin from the plugin maintainer smackcoders. Sites that have enabled the import feature for users with Contributor or higher roles are vulnerable. No specific operating system or server configurations are listed, but the issue applies wherever the plugin is installed and accessible to those roles.", "description_and_impact": "The vulnerability resides in the WP Import \u2013 Ultimate CSV XML Importer plugin, where authenticated users with Contributor-level access can cause the server to resolve a Bitly shortlink and subsequently follow redirects to an unvalidated URL. The plugin performs initial validation on the supplied URL, but after detecting a Bitly link it calls a function that automatically follows redirects without re\u2011validating the final destination. This allows the attacker to force the server to issue outbound HTTP requests to arbitrary internal addresses, including localhost, private IP ranges, or cloud metadata services, potentially leaking sensitive data and exposing internal resources.", "risk_and_exploitability": "The CVSS score of 6.4 classifies this as a medium risk vulnerability. The EPSS score of less than 1% indicates a very low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with Contributor or higher privilege and the ability to trigger the import function. If exploited, it can lead to disclosure of internal information and potential lateral movement within the network, but it does not grant arbitrary code execution on the server."}}}}, "created": "2026-01-05T10:14:52.485682+00:00", "updated": "2026-04-21T17:00:12.321747+00:00", "vendors": ["smackcoders", "smackcoders$PRODUCT$an_ultimate_wordpress_importer_cum_migration_as_csv_\\&_xml", "smackcoders$PRODUCT$ultimate_csv_importer", "smackcoders$PRODUCT$wp_ultimate_csv_importer", "wordpress", "wordpress$PRODUCT$wordpress"]}