WordPress Awesome Import & Export Plugin Privilege Escalation and Arbitrary SQL Execution Vulnerability

A vulnerability allowing arbitrary SQL execution and privilege escalation has been identified in the WordPress Awesome Import & Export Plugin - Import & Export WordPress Data, affecting all versions through 4.1.1. The issue arises from a missing capability check in the renderImport() function, which enables authenticated attackers with Subscriber-level access and above to execute arbitrary SQL statements. This could be exploited to create a new administrative user account.

Impact

Exploitation of this vulnerability could lead to unauthorized SQL execution, allowing attackers to manipulate the database. Additionally, it could be used to escalate privileges by creating a new administrative user account.