WordPress plugin
WP All Import Pro security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 10 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High5
- Medium5
- Low0
All WP All Import Pro vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Administrator+) PHP Object Injection via Import File ≤4.9.7Update to 4.9.8 | CVE-2024-9664 | |
| High7.6 | Authenticated (Administrator+) Server-Side Request Forgery via File Import ≤4.9.3Update to 4.9.4 | CVE-2024-9624 | |
| High8.8 | SQL injection <4.1.2Update to 4.1.2 | — | |
| High7.2 | SQL Injection ≤4.1.1Update to 4.1.2 | — | |
| High7.5 | Missing Authorization Checks <4.1.1Update to 4.1.1 | CVE-2015-9331 |
- High7.2Authenticated (Administrator+) PHP Object Injection via Import File
≤4.9.7Update to 4.9.8
- High7.6Authenticated (Administrator+) Server-Side Request Forgery via File Import
≤4.9.3Update to 4.9.4
- High8.8SQL injection
<4.1.2Update to 4.1.2
- High7.2SQL Injection
≤4.1.1Update to 4.1.2
- High7.5Missing Authorization Checks
<4.1.1Update to 4.1.1
WP All Import Pro: common questions
Does WP All Import Pro have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in WP All Import Pro: 5 high, 5 medium. None are known to affect version null.
How do I check which version of WP All Import Pro I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP All Import Pro vulnerability?
CVE-2024-9661, published Feb 7, 2025: WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion. Severity: Medium (CVSS 4.3).
Is any WP All Import Pro vulnerability listed in CISA KEV?
No. None of the known WP All Import Pro vulnerabilities is currently listed in the CISA KEV catalog.