CVE-2024-9661
WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
| CWE | CWE-352 |
| Vendor | soflyy |
| Product | wp all import pro |
| Published | Feb 7, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for soflyy wp all import pro
Be the first to know when new medium vulnerabilities affecting soflyy wp all import pro are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Soflyy / WP All Import Pro
0 ≤ 4.9.7
References
Credits
Francesco Carlucci