Import WP < 2.13.1 - Admin+ Server-side Request Forgery

Published 2 y ago 2024-04-24 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 47%

Public exploits

none known

The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: partial
Assessed: 2 y ago 2024-07-01

Exploit prediction (EPSS)

0.57% probability of exploitation in the next 30 days, higher than 47% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N`
CNA	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N`

Affected products

Unknown Import WP
importwp import_wp

Classification

Weakness

CWE-918 Server-Side Request Forgery

References

wpscan.com /vulnerability/aeefcc01-bbbf-4d86-9cfd-ea0f9a85e1a5/ · exploit, vdb-entry, technical-description, x_transferred

Sources

CVE List: CVE-2023-7253
NVD: CVE-2023-7253

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary