Import external attachments
Import external attachments has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Missing Authorization.
None of the 2 issues recorded for Import external attachments have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. Import external attachments is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.4.34.
CVE-2025-64245Import external attachments <= 1.5.12 - Missing Authorization
Read the full analysisVulnerability Records
Import external attachments
Author
ryanpcmcquen
Makes local copies of all the linked images and pdfs in a post, adding them as gallery attachments. Source & support: https://github.com/ryanpcmcquen/import-external-attachments Credits This plugin is based on the work done in the “Import External Images” plugin by MartyThornley. https://github.com/MartyThornley HTTPS support added by IvanDoomer: https://github.com/IvanDoomer PDF support added by bengreeley: https://github.com/bengreeley Most of the JavaScript was rewritten from the original plugin, to reduce the number of global variables.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C