PT-2025-5987 · WordPress · Wp All Export Pro

Francesco Carlucci · Published 2025-02-07 · Updated 2025-02-11 · CVE-2024-7419

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP ALL Export Pro plugin for WordPress versions up to, and including, 1.9.1

Description The issue is related to the lack of input validation and sanitization of user-supplied data in the custom export fields. This allows unauthenticated attackers to inject arbitrary PHP code into form fields that get executed on the server during the export, potentially leading to a complete site compromise. The custom export field must include fields containing user-supplied data for this issue to occur.

Recommendations For WP ALL Export Pro plugin for WordPress versions up to, and including, 1.9.1, update to a version higher than 1.9.1 to resolve the issue. As a temporary workaround, consider disabling the custom export fields until a patch is available. Restrict access to the custom export fields to minimize the risk of exploitation. Avoid using the custom export fields that contain user-supplied data until the issue is resolved.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-7419

Affected Products

Wp All Export Pro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-7419 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7419 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/40b57370-4fd7-4316-9e99-a3f1d34616e8?source=cve · Note
• https://t.me/cvedetector/17493 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1887926331087651102 · Twitter Post
• https://twitter.com/CVEnew/status/1887889069260022218 · Twitter Post
• https://wpallimport.com/upgrade-to-wp-all-export-pro · Note
• https://t.me/cvenotify/110916 · Telegram Post