CVE-2024-7425 Details

A vulnerability in the WP All Export Pro plugin for WordPress, present in all versions through 1.9.1, allows for unauthorized data modification that could lead to privilege escalation. This issue arises from inadequate validation and sanitization of user input, enabling authenticated attackers with Shop Manager-level access or higher to alter arbitrary options on the WordPress site. Exploitation of this vulnerability could involve changing the default registration role to administrator and activating user registration, thereby granting administrative access to the attacker on the compromised site.

Users are advised to update the WP All Export Pro plugin to version 1.9.2 or a later patched version.