The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Published August 20, 2019.
Soflyy WP All Import