WP All Import Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the WP All Import plugin for WordPress, affecting all versions up to and including 3.9.6. The issue arises from the use of eval() on unsanitized user input in the pmxi_if function within helpers/functions.php. This vulnerability allows authenticated attackers with import capabilities, typically administrators, to inject and execute arbitrary PHP code on the server by using crafted import templates.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the vulnerable WordPress site is hosted.

Remediation

Users are advised to update the WP All Import plugin to version 4.0.0 or a newer patched version.