Read the docs
TI-2024-06881 Aliases CVE-2024-7425GHSA-xq2h-7fp3-456v

WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update

Priority LOW 34CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and including, 1.9.1. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WP All ImportWP All Export Proup to 1.9.1—No fix listedCNA
  • WP All Export Pro VendorWP All Import Affected up to 1.9.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:soflyy:wp_all_export:*:*:*:*:pro:wordpress:*:*before 1.9.2VulnerableSoflyy
  • cpe:2.3:a:soflyy:wp_all_export:*:*:*:*:pro:wordpress:*:* Versions before 1.9.2 Vulnerable ·Soflyy

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7425
  2. 2026-10-03 Alias added: GHSA-xq2h-7fp3-456v

References

Advisory 1

Other 1

  • TI-2022-01436 Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload CVSS 3.1HIGH 7.2
  • TI-2025-11669 Code injection in WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets CVSS 3.1HIGH 8.8
  • TI-2024-06875 WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields CVSS 3.1HIGH 8.8
  • TI-2025-09180 Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload CVSS 3.1HIGH 7.2
  • TI-2026-41454 WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability CVSS 3.1HIGH 7.6
  • TI-2024-21326 WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection CVSS 3.1HIGH 7.2
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences