CVE-2024-9661

Name of the Vulnerable Software and Affected Versions WP All Import Pro versions up to and including 4.9.7

Description The issue is related to cross-site request forgery due to missing nonce validation in the delete and edit function. This allows unauthenticated attackers to delete imported content, such as posts, comments, and users, by tricking a site administrator into performing an action like clicking on a link.

Recommendations For versions up to and including 4.9.7, update to a version higher than 4.9.7 to resolve the issue. As a temporary workaround, consider restricting access to the delete and edit function until a patch is available. Additionally, be cautious when clicking on links from untrusted sources to minimize the risk of exploitation.