WP All Import Pro Cross-Site Request Forgery Vulnerability Allowing Content Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WP All Import Pro plugin for WordPress, affecting all versions through 4.9.7. The issue arises from inadequate nonce validation in the delete_and_edit function, enabling unauthenticated attackers to delete imported content such as posts, comments, and users. This exploitation requires tricking a site administrator into clicking a link that initiates the deletion.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of imported content, including posts, comments, and users, from a WordPress site.

Remediation

Users can update to WP All Import Pro version 4.9.8 or a newer patched version to address this vulnerability.