WordPress WP All Import Pro Plugin <= 4.9.3 is vulnerable to Server Side Request Forgery (SSRF)<\/p>
Software: WP All Import Pro<\/p>
Fixed in version 4.9.4 <\/p>
Affected Version <= 4.9.3<\/p>
CVE: CVE-2024-9624<\/p>","date":"2024-12-16"},{"id":"EUVD-2024-50418","name":"EUVD-2024-50418","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-50418","description":"The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance metadata.","date":"2024-12-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"h","i":"l","a":"n","score":"7.6","severity":"h","exploitable":"2.3","impact":"4.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:L\/A:N","score":"7.6","severity":"high","av":"network","ac":"low","pr":"high","ui":"none","s":"changed","c":"high","i":"low","a":"none","exploitable":"2.3","impact":"4.7"},"cwe":[{"cwe":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.001"}},{"uuid":"5bbe41ee497af132826c8c5737c8973f71daef3f7d3d56cf27a18d474019de37","name":"WP All Import Pro [wp-all-import-pro] < 4.9.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-8722","name":"WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-8722","description":"The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.","date":"0000-00-00"},{"id":"1ec1636a9498416ca3dbaa06530c75b718b24d35","name":"WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-all-import-pro\/wp-all-import-pro-497-authenticated-administrator-stored-cross-site-scripting-via-svg-file-upload","description":"The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.","date":"2025-01-18"},{"id":"EUVD-2024-49580","name":"EUVD-2024-49580","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-49580","description":"The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.","date":"2025-01-19"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"5.5","severity":"medium","av":"network","ac":"low","pr":"high","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"030b8ed99984dd06fce9f52eea19ca5b76758bcb7d14ccf98274c1a709514f19","name":"WP All Import Pro [wp-all-import-pro] < 4.9.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-9661","name":"WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9661","description":"The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.","date":"0000-00-00"},{"id":"5745f3e320c9e31eb48d7d6da3e3eab5aa8c6a18","name":"WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-all-import-pro\/wp-all-import-pro-497-cross-site-request-forgery-to-imported-content-deletion","description":"The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2025-02-07"},{"id":"EUVD-2024-53880","name":"EUVD-2024-53880","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-53880","description":"The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2025-02-07"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"a153c22f4d68671bcaefe1192bf80fbdd1cecf9657473b6b54aa8bdec10f3d97","name":"WP All Import Pro [wp-all-import-pro] < 4.9.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-9664","name":"WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9664","description":"The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","date":"0000-00-00"},{"id":"e84d097b5f4457fe3266c5b140c4aee526d0b918","name":"WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-all-import-pro\/wp-all-import-pro-497-authenticated-administrator-php-object-injection-via-import-file","description":"The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","date":"2025-02-07"},{"id":"EUVD-2024-53887","name":"EUVD-2024-53887","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-53887","description":"The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.","date":"2025-02-07"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"h","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"7.2","severity":"h","exploitable":"1.2","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"7.2","severity":"high","av":"network","ac":"low","pr":"high","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"1.2","impact":"5.9"},"cwe":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","description":"The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null},"epss":"0.004"}}]},"updated":"1785853658"}