Arbitrary SQL Execution and Privilege Escalation in Awesome Import & Export Plugin for WordPress

CVE-2024-13232

Summary

The Awesome Import & Export Plugin for WordPress contains a vulnerability that permits arbitrary SQL execution and privilege escalation due to a missing capability check in the renderImport() function. This flaw affects all versions up to and including 4.1.1, enabling authenticated attackers with Subscriber-level access and higher to execute unauthorized SQL queries. Such access can be compromised to create new administrative user accounts, posing a significant security risk for WordPress installations.

References