CVE-2024-32835: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability was discovered in WebToffee Import Export WordPress Users plugin, affecting versions through 2.5.3. The vulnerability was identified on March 15, 2024, by Trình Vũ from VNPT-VCI and was assigned CVE-2024-32835. The issue was publicly disclosed on April 22, 2024 (Patchstack Database).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). It received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility with high attack complexity, no privileges required, and no user interaction needed (Patchstack Database).

The vulnerability could potentially be exploited to execute commands to gain access to the admin panel, exploit website logic, or cause a denial of service. The specific impact may vary case by case, though the overall severity is considered low (Patchstack Database).

The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited. Administrator privileges are required for exploitation (Patchstack Database).

The vulnerability has been fixed in version 2.5.4 of the plugin. Users are advised to update to version 2.5.4 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack Database).