CVE-2025-14627

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after following Bitly shortlink redirects in the `upload_function()` method. While the initial URL is validated using `wp_http_validate_url()`, when a Bitly shortlink is detected, the `unshorten_bitly_url()` function follows redirects to the final destination URL without re-validating it. This makes it possible for authenticated attackers with Contributor-level access or higher to make the server perform HTTP requests to arbitrary internal endpoints, including localhost, private IP ranges, and cloud metadata services (e.g., 169.254.169.254), potentially exposing sensitive internal data.

• CWE-918

• https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L290
• https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.34/uploadModules/UrlUpload.php#L73
• https://plugins.trac.wordpress.org/changeset/3421699/wp-ultimate-csv-importer/trunk/uploadModules/UrlUpload.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/87040f2b-4de0-4a8d-ae30-b340638a6df2?source=cve

Published

Jan 1, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14620A vulnerability was determined in code-projects Student File…9.8
• CVE-2025-14621A vulnerability was identified in code-projects Student File…9.8
• CVE-2025-14622A security flaw has been discovered in code-projects Student…9.8
• CVE-2025-14623A weakness has been identified in code-projects Student File…9.8
• CVE-2025-14625Uncontrolled Search Path Element vulnerability in Altera Qua…6.7
• CVE-2025-14626The QR Code for WooCommerce order emails, PDF invoices, pack…6.4
• CVE-2025-14629The Alchemist Ajax Upload plugin for WordPress is vulnerable…5.3
• CVE-2025-1463The Spreadsheet Integration plugin for WordPress is vulnerab…4.3
• CVE-2025-14630The AdminQuickbar plugin for WordPress is vulnerable to Cros…4.3
• CVE-2025-14631A NULL Pointer Dereference vulnerability in TP-Link Archer B…6.5
• CVE-2025-14632The Filr – Secure document library plugin for WordPress is v…4.4
• CVE-2025-14633The F70 Lead Document Download plugin for WordPress is vulne…5.3