CVE-2024-9664
📋 TL;DR
The WP All Import Pro plugin for WordPress is vulnerable to PHP object injection through deserialization of untrusted import files. This allows authenticated attackers with Administrator privileges to inject malicious PHP objects. If a POP chain exists via other installed plugins or themes, this could lead to file deletion, data theft, or remote code execution.
💻 Affected Systems
- WP All Import Pro WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or website defacement if a suitable POP chain exists in the environment.
Likely Case
Limited impact due to requirement for Administrator access and specific POP chain dependencies, but potential for data manipulation or limited file operations.
If Mitigated
Minimal impact with proper access controls, regular patching, and limited plugin installations reducing POP chain availability.
🎯 Exploit Status
Exploitation requires Administrator access and depends on available POP chains from other installed components.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 4.9.8 or later
Vendor Advisory: https://www.wpallimport.com/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP All Import Pro. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from vendor and upload via FTP.
🔧 Temporary Workarounds
Disable Import Functionality
allTemporarily disable the import feature until patching is possible
Restrict Administrator Access
allLimit Administrator accounts to trusted personnel only
🧯 If You Can't Patch
- Remove or disable the WP All Import Pro plugin entirely
- Implement strict file upload validation and monitoring for import activities
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins > Installed PluginsCheck Version:
wp plugin list --name='WP All Import Pro' --field=versionVerify Fix Applied:
Confirm WP All Import Pro version is 4.9.8 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual import file uploads by Administrator users
- PHP deserialization errors in web server logs
- Unexpected file operations following imports
Network Indicators:
- Large or unusual file uploads to import endpoints
- POST requests to import functionality with serialized data
SIEM Query:
source="web_logs" AND (uri_path="/wp-admin/admin-ajax.php" OR uri_path CONTAINS "import") AND (user_agent CONTAINS "serialize" OR post_data CONTAINS "O:")