Read the docs
TI-2022-03138 Aliases CVE-2022-3395GHSA-m95q-f33m-cqcq

WP All Export Pro < 1.7.9 - Authenticated SQLi

Priority HIGH 73CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been given permission to run exports to execute arbitrary SQL statements, leading to a SQL Injection vulnerability. By default only users with the Administrator role can perform exports, but this can be delegated to lower privileged users as well.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01246 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP All Export Pro (Unknown): 1.7.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP All Export Pro1.7.9 to before 1.7.91.7.9Patch availableCNA
  • WP All Export Pro VendorUnknown Affected 1.7.9 to before 1.7.9 Fixed in 1.7.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:soflyy:wp_all_export:*:*:*:*:pro:wordpress:*:*before 1.7.9VulnerableSoflyy
  • cpe:2.3:a:soflyy:wp_all_export:*:*:*:*:pro:wordpress:*:* Versions before 1.7.9 Vulnerable ·Soflyy

Remediation

  • Fix · CNA WP All Export Pro (Unknown) Fixed in 1.7.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WP All Export Pro 1.7.9

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2022-03137 WP All Export Pro < 1.7.9 - Authenticated Code InjectionPriority HIGH 67
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3395
  2. 2026-10-03 Alias added: GHSA-m95q-f33m-cqcq

References

Exploit 1

  • TI-2023-05417 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF CVSS 3.1HIGH 8.8
  • TI-2023-04352 WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE CVSS 3.1HIGH 7.2
  • TI-2022-03137 WP All Export Pro < 1.7.9 - Authenticated Code Injection CVSS 3.1HIGH 7.2
  • TI-2024-06875 WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields CVSS 3.1HIGH 8.8
  • TI-2023-05420 WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF CVSS 3.1HIGH 8.8
  • TI-2024-06881 WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences