CVE-2024-32431 MEDIUM

CVE-2024-32431: WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection

Vendor Wp All Import
Product Import Users from CSV
Weakness CWE-502 · Unsafe deserialization
Published April 15, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in WP All Import Import Users from CSV.This issue affects Import Users from CSV: from n/a through 1.2.

Explanation of Vulnerability in Simple Terms

02Summary

Import Users from CSV versions up to 1.2 contain a deserialization vulnerability in user import handling. An authenticated administrator can craft a malicious CSV file that, when imported, deserializes untrusted data. This could allow the attacker to read sensitive site information or modify data. The vulnerability requires high-level access and careful file construction to exploit.

What an attacker can do

03Attacker Capabilities

Read sensitive site data or modify information by uploading a crafted CSV file during user import.

Potential impact on your site

04Site Impact

An admin account could be compromised to leak data or alter site content via malicious CSV imports.

Conditions required to exploit

05Prerequisites

Administrator account access and ability to upload a CSV file to the import function.

Key dates

06Disclosure timeline

April 15, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-49781 WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability CVE-2025-11993 WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection CVE-2026-49085 WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability CVE-2026-39481 WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability CVE-2026-65497 WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability