What the vulnerability does
01Description
The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalation due to a missing capability check on the renderImport() function in all versions up to, and including, 4.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary SQL statements that can leveraged to create a new administrative user account.
Explanation of Vulnerability in Simple Terms
02Summary
The WordPress Awesome Import & Export Plugin through version 4.1.1 lacks proper authorization checks on its import and export functions. A logged-in user with low privileges can import or export WordPress data without appropriate permission validation, potentially accessing or modifying sensitive site content. This affects all versions up to and including 4.1.1.
What an attacker can do
03Attacker Capabilities
A low-privilege user can import or export WordPress data without proper authorization checks.
Potential impact on your site
04Site Impact
Unauthorized users can access, modify, or exfiltrate sensitive WordPress data like posts, users, and settings.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
March 5, 2025
CVE published
April 8, 2026
Record updated
