Import CDN-Remote Images

Import CDN-Remote Images has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Import CDN-Remote Images has a vendor fix available, so running the current release closes it.

All of these findings were reported by Skalucy. Import CDN-Remote Images is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Import CDN-Remote Images vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2025-48153

Import CDN-Remote Images <= 2.1.2 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
Import CDN-Remote Images banner
Latestv2.1.4

Import CDN-Remote Images

Atakan Au

Author

Atakan Au

5.0(4)
100/100
Last Updated
2026-08-18 (25d ago)
Active Installs
100+
Downloads
5,784
Requires WP
4.7.4+
Requires PHP
5.6+
Tested up to
WP 7.1
Created
2020-08-18 (6y ago)

By default, adding an image to the WordPress media library requires you to import or upload the image to the WordPress site, which means there must be a copy of the image file stored in the site. This plugin enables you to add an image stored in an external site to the media library by just reading list of remote images using CDN service’s (Cloudinary) API. In this way you can host the images in a dedicated server other than the WordPress site, and still be able to show them by various gallery plugins which only take images from the media library. The plugin provides a dedicated &#8216;Media’ -> &#8216;Import images’ submenu page. Supported CDN services: * Cloudinary (others coming soon) External Services This plugin connects to an external service provided by Cloudinary to retrieve and display media assets. What the service is: Cloudinary is a cloud-based media management service. The plugin uses the Cloudinary API to fetch and display remote images and videos. Why it is used: The plugin retrieves media assets from Cloudinary instead of storing them locally in WordPress. This allows centralized media management and delivery via Cloudinary. When data is sent: Data is sent only when the user configures the plugin and performs actions such as importing or synchronizing media. What data is sent: Cloud name API key API secret (used for authenticated requests) Requests to list media resources How it works: The plugin communicates with Cloudinary using REST APIs over HTTPS. It uses the Cloudinary Admin API to list media resources. Example endpoint structure: https://api.cloudinary.com/v1_1/{cloud_name}/resources API requests are authenticated using the API key and API secret. What is not sent: No personal user data is transmitted unless explicitly configured by the site administrator. Documentation and policies: Cloudinary API documentation General documentation Terms of Service Privacy Policy Support Support requests, bug reports, feedback, and feature requests can be submitted via the support forum or the plugin’s blog page: Import CDN-Remote Images Plugin. If you find the plugin useful, please consider leaving a 5-star review. You can also support my work with a donation. Collaboration I am a freelance developer available for custom development, integrations, and technical consulting. If you have a project related to this plugin, feel free to get in touch.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C