PT-2025-5988 · WordPress · Wp All Import Pro

Francesco Carlucci · Published 2025-02-07 · Updated 2025-02-07 · CVE-2024-9661

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP All Import Pro versions up to and including 4.9.7

Description The issue is related to cross-site request forgery due to missing nonce validation in the delete and edit function. This allows unauthenticated attackers to delete imported content, such as posts, comments, and users, by tricking a site administrator into performing an action like clicking on a link.

Recommendations For versions up to and including 4.9.7, update to a version higher than 4.9.7 to resolve the issue. As a temporary workaround, consider restricting access to the delete and edit function until a patch is available. Additionally, be cautious when clicking on links from untrusted sources to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-9661

Affected Products

Wp All Import Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-9661 · Security Note
• https://wpallimport.com · Note
• https://twitter.com/CVEnew/status/1887889068265967703 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1887921210689777953 · Twitter Post
• https://t.me/cvedetector/17494 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b5f8659a-fb3f-4df3-85a6-979751627a9c?source=cve · Note