CVE-2024-31308 MEDIUM

CVE-2024-31308: WordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerability

Vendor Vjinfotech

Product WP Import Export Lite

Weakness CWE-502 · Unsafe deserialization

Published April 7, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.4/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.This issue affects WP Import Export Lite: from n/a through 3.9.26.

Explanation of Vulnerability in Simple Terms

02Summary

WP Import Export Lite versions up to 3.9.26 contain a deserialization vulnerability in how they process imported data. An authenticated administrator with high privileges can craft malicious serialized data that, when imported, may allow them to read or modify site data. The attack requires deliberate action and specific conditions to exploit.

What an attacker can do

03Attacker Capabilities

Read or modify site data through malicious serialized input during import operations.

Potential impact on your site

04Site Impact

An admin account could be compromised to read or alter site content and settings via import functionality.

Conditions required to exploit

05Prerequisites

Administrator account with high privileges; attacker must craft and upload malicious serialized data.

Key dates

06Disclosure timeline

April 7, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-31308 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities

Identifiers

CVE CVE-2024-31308

CWE CWE-502

CVSS 4.4 / MEDIUM

Affected versions