CVE-2024-7425: 
WordPress vulnerability analysis and mitigation

The WP ALL Export Pro plugin for WordPress (versions up to and including 1.9.1) contains a privilege escalation vulnerability due to improper user input validation and sanitization (NVD). This vulnerability allows authenticated attackers with Shop Manager-level access or higher to update arbitrary options on WordPress sites.

The vulnerability stems from improper user input validation and sanitization in the plugin. Authenticated users with Shop Manager-level privileges can exploit this to update arbitrary options on the WordPress site. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility with high privileges required (NVD).

The vulnerability can be leveraged to update the default role for registration to administrator and enable user registration, allowing attackers to gain administrative user access to vulnerable sites. This effectively enables privilege escalation from Shop Manager to Administrator level access (NVD).

Site administrators should upgrade to a version newer than 1.9.1 of the WP ALL Export Pro plugin to address this vulnerability (WP All Import).