WP All Export Pro Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the WP All Export Pro plugin for WordPress, affecting all versions through 1.9.1. The issue arises from inadequate input validation and sanitization of user-supplied data in custom export fields. This vulnerability allows unauthenticated attackers to inject arbitrary PHP code into form fields, which is executed on the server during the export process, potentially compromising the entire site. The vulnerability requires the custom export field to include user-supplied data.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where WordPress is hosted, with the executed code running in the context of the web server.

Remediation

Users are advised to update the WP All Export Pro plugin to version 1.9.2 or a newer patched version.