CVE-2024-9661

Summary

CVE-2024-9661 is a newly disclosed vulnerability affecting the WP All Import Pro plugin for WordPress. Versions up to and including 4.9.7 are vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of nonce validation on the delete_and_edit function. This issue allows unauthenticated attackers to delete imported content, such as posts, comments, and users, by tricking a site administrator into executing a malicious request. The vulnerability poses a significant risk to websites using the WP All Import Pro plugin and highlights the importance of implementing proper CSRF protection measures.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.