Executive brief
WP All Import is a popular WordPress plugin used to import data from XML, CSV, and Excel files into website content. A security vulnerability allows an administrative user to execute unauthorized database commands, which could lead to the theft of sensitive site information or disruption of services. While the risk is mitigated by the requirement for high-level administrative access, organizations should update to prevent potential internal abuse or escalation of other attacks.
Technical details
A SQL injection vulnerability exists in the WP All Import plugin for WordPress due to improper neutralization of special elements in SQL commands (CWE-89). The flaw is present in versions up to and including 4.0.1. An attacker with Administrator-level privileges can exploit this over the network without user interaction to interact directly with the underlying database. This could allow for the extraction of sensitive data or limited impact on database availability. The issue is addressed in version 4.1.0.
Affected products
- WP All Import WP All Import <= 4.0.1
Timeline
- 2026-06-04: other: Reported by researcher Ananda Dhakal
- 2026-06-26: advisory: Published by Patchstack
- 2026-06-26: patched: Fixed in version 4.1.0