CVE-2024-9664: 
WordPress vulnerability analysis and mitigation

The WP All Import Pro plugin for WordPress contains a PHP Object Injection vulnerability (CVE-2024-9664) affecting all versions up to and including 4.9.7. The vulnerability was discovered and disclosed in February 2025, impacting WordPress installations using the affected plugin versions (NVD).

The vulnerability stems from the deserialization of untrusted input from import files. This security flaw has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) (NVD, Wordfence).

If exploited, the vulnerability could allow attackers to delete arbitrary files, retrieve sensitive data, or execute code on the target system. However, this is contingent upon the presence of a POP chain via an additional plugin or theme installed on the target system (NVD).

The vulnerability requires authenticated attackers with Administrator-level access or above to exploit. Currently, no known POP chain is present in the vulnerable software itself (NVD).

Users should upgrade to version 4.9.8 or later of the WP All Import Pro plugin to address this vulnerability (NVD, WP All Import).