Vulnerability Description
The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into form fields that get executed on the server during the export, potentially leading to a complete site compromise. As a prerequisite, the custom export field should include fields containing user-supplied data.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Soflyy | Wp All Export | < 1.9.2 |
Related Weaknesses (CWE)
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/40b57370-4fd7-4316-9e9Third Party Advisory
- https://www.wpallimport.com/upgrade-to-wp-all-export-pro/Product
FAQ
What is CVE-2024-7419?
CVE-2024-7419 is a vulnerability with a CVSS score of 8.3 (HIGH). The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation ...
How severe is CVE-2024-7419?
CVE-2024-7419 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-7419?
Check the references section above for vendor advisories and patch information. Affected products include: Soflyy Wp All Export.