Read the docs
TI-2022-03137 Aliases CVE-2022-3394GHSA-vh4p-xvjw-q6rc

WP All Export Pro < 1.7.9 - Authenticated Code Injection

Priority HIGH 67CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02021 81st percentileScored 2026-11-08
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP All Export Pro (Unknown): 1.7.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP All Export Pro1.7.9 to before 1.7.91.7.9Patch availableCNA
  • WP All Export Pro VendorUnknown Affected 1.7.9 to before 1.7.9 Fixed in 1.7.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:soflyy:wp_all_export:*:*:*:*:pro:wordpress:*:*before 1.7.9VulnerableSoflyy
  • cpe:2.3:a:soflyy:wp_all_export:*:*:*:*:pro:wordpress:*:* Versions before 1.7.9 Vulnerable ·Soflyy

Remediation

  • Fix · CNA WP All Export Pro (Unknown) Fixed in 1.7.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WP All Export Pro 1.7.9

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2022-03138 WP All Export Pro < 1.7.9 - Authenticated SQLiPriority HIGH 73
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3394
  2. 2026-10-03 Alias added: GHSA-vh4p-xvjw-q6rc

References

Exploit 1

  • TI-2023-05417 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF CVSS 3.1HIGH 8.8
  • TI-2022-03138 WP All Export Pro < 1.7.9 - Authenticated SQLi CVSS 3.1HIGH 8.8
  • TI-2023-04352 WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE CVSS 3.1HIGH 7.2
  • TI-2024-06875 WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields CVSS 3.1HIGH 8.8
  • TI-2023-05420 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF CVSS 3.1HIGH 8.8
  • TI-2024-06881 WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences