WP All Import Pro PHP Object Injection Vulnerability in WordPress

A PHP Object Injection vulnerability has been identified in the WP All Import Pro plugin for WordPress, affecting all versions through 4.9.7. The vulnerability arises from the deserialization of untrusted input from import files, allowing authenticated attackers with Administrator-level access to inject PHP objects. While the vulnerable software does not have a known proof-of-concept chain, the presence of such a chain through an additional plugin or theme could enable the attacker to delete arbitrary files, access sensitive data, or execute code.

Impact

Exploitation of this vulnerability could lead to unauthorized PHP object injection, with potential consequences depending on the presence of a proof-of-concept chain via other plugins or themes.

Remediation

Users are advised to update the WP All Import Pro plugin to version 4.9.8 or a newer patched version.