CVE-2024-9664 is a PHP Object Injection vulnerability affecting all versions of the WP All Import Pro plugin for WordPress up to and including 4.9.7. This flaw allows authenticated attackers with Administrator-level access to inject PHP Objects through untrusted input in import files. While no native POP chain exists within the plugin, a successful exploit leveraging a POP chain from other installed plugins or themes could lead to arbitrary file deletion, sensitive data retrieval, or remote code execution. The vulnerability has a CVSS score of 7.2 (HIGH), indicating a high potential impact, but currently has no known public exploits, Metasploit modules, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.9.8CPE matchmatch criteria | cpe:2.3:a:soflyy:wp_all_import:*:*:*:*:pro:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.