Cross-Site Request Forgery Vulnerability in WP All Import Pro by WordPress

CVE-2024-9661

What is CVE-2024-9661?

The WP All Import Pro plugin for WordPress is exposed to a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in the delete_and_edit function. This flaw permits unauthenticated attackers to manipulate site content, such as deleting posts, comments, and users, through crafted requests. If a site administrator is tricked into executing a specific action, harmful operations can occur without their knowledge, potentially leading to significant content loss.

References