CVE-2023-4724: WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-12-18 · updated 2026-06-17

Description

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server

Affected products

Soflyy Export Any Wordpress Data To Xml/Csv: before 1.4.0 — fixed in 1.4.0
WP All Export Pro: before 1.8.6 — fixed in 1.8.6

How to fix

Upgrade to a fixed version: Soflyy Export Any Wordpress Data To Xml/Csv 1.4.0; WP All Export Pro 1.8.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f
https://wpscan.com/vulnerability/48820f1d-45cb-4f1f-990d-d132bfc5536f

Get alerted when CVE-2023-4724 or the next vulnerability affects your stack