CVE-2024-7419: WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields
First published: Fri Feb 07 2025(Updated: )
The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into form fields that get executed on the server during the export, potentially leading to a complete site compromise. As a prerequisite, the custom export field should include fields containing user-supplied data.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WP All Export | <=1.9.1 | |
| WP All Export | <1.9.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7419?
CVE-2024-7419 is considered a critical vulnerability due to its potential for Remote Code Execution.
How do I fix CVE-2024-7419?
To fix CVE-2024-7419, upgrade WP ALL Export Pro to version 1.9.2 or later.
Who is affected by CVE-2024-7419?
CVE-2024-7419 affects all versions of WP ALL Export Pro up to and including version 1.9.1.
What is the attack vector for CVE-2024-7419?
The attack vector for CVE-2024-7419 is via unauthenticated users exploiting the custom export fields.
What causes the vulnerability identified as CVE-2024-7419?
CVE-2024-7419 is caused by missing input validation and sanitization of user-supplied data.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- agent/source
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/wp all export
- canonical/wp all export
- vendor/soflyy