Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
medium
The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This is due to the plugin using wp_remote_get() to fetch a user-supplied URL without validating that the URL does not point to internal or private network resources in the demo_download_and...
- CVSS:
- 6.4
- Affected:
- up to 1.4.6
- Fixed in:
- 2.0.0
- Disclosed:
- Jun 18, 2026
CVE-2026-4328 on NVD →
Advanced Import <= 1.3.7 - Cross-Site Request Forgery
high
The Advanced Import plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.7. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to enable and disable arbitrary plugins, via forged request grante...
- CVSS:
- 8.8
- Affected:
- up to 1.3.7
- Fixed in:
- 1.3.8
- Disclosed:
- Nov 14, 2022
CVE-2022-3677 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database