CVE-2024-13232 Overview
CVE-2024-13232 affects the WordPress Awesome Import & Export Plugin, which handles bulk import and export of WordPress data. The vulnerability stems from a missing capability check on the renderImport() function. All plugin versions up to and including 4.1.1 are affected. Authenticated users with Subscriber-level access or above can execute arbitrary SQL statements against the WordPress database. Attackers can leverage this primitive to create a new administrative user account and take over the site. The issue is classified as Missing Authorization [CWE-862].
Critical Impact
A Subscriber-level account is sufficient to execute arbitrary SQL and escalate to full WordPress administrator, resulting in complete site compromise.
Affected Products
- WordPress Awesome Import & Export Plugin versions ≤ 4.1.1
- WordPress sites where any user registration is permitted (Subscriber role)
- WordPress installations exposing the plugin's import handler to authenticated users
Discovery Timeline
- 2025-03-05 - CVE-2024-13232 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13232
Vulnerability Analysis
The vulnerability resides in the plugin's renderImport() function, which processes import operations for WordPress data. The function fails to verify that the calling user holds an appropriate WordPress capability such as manage_options or import. Any authenticated user, including low-privileged Subscribers, can reach the handler. Because the import path accepts SQL content that is executed against the WordPress database, the missing check turns an administrative feature into a direct SQL execution primitive for any logged-in account.
Root Cause
The root cause is a Missing Authorization defect [CWE-862]. WordPress plugins are expected to gate privileged actions using current_user_can() checks or nonce validation tied to capability checks. The renderImport() function omits this enforcement, so the WordPress request lifecycle authenticates the user but never authorizes the action. The plugin also trusts import payload contents to reach SQL execution routines without restricting who can supply them.
Attack Vector
An attacker first obtains any authenticated session on the target site. On sites with open registration, this only requires signing up for a Subscriber account. The attacker then invokes the plugin's import action and submits crafted SQL. A typical payload inserts a new row into wp_users with a chosen password hash and adds an entry to wp_usermeta granting the administrator role. The attacker then logs in with the newly created administrator credentials and can install malicious plugins or themes for persistent code execution. See the Wordfence Vulnerability Report for further technical context.
Detection Methods for CVE-2024-13232
Indicators of Compromise
- Unexpected new user accounts assigned to the administrator role in wp_users and wp_usermeta
- Requests from low-privileged sessions to the plugin's import endpoint containing SQL keywords such as INSERT, UPDATE, or wp_users
- Newly installed plugins, themes, or modified functions.php files immediately following administrator account creation
Detection Strategies
- Audit the WordPress user table for administrators created after the plugin was installed and correlate creation timestamps with web server logs
- Inspect access logs for authenticated POST requests to the Awesome Import & Export Plugin's AJAX or admin-post handlers originating from Subscriber-level sessions
- Deploy a Web Application Firewall (WAF) rule to flag SQL fragments referencing wp_users, wp_usermeta, or user_pass within import parameters
Monitoring Recommendations
- Alert on any privilege change or role assignment to administrator outside of change windows
- Monitor for creation of PHP files under wp-content/uploads and modifications to plugin or theme files following the exploit window
- Track sessions where a Subscriber account issues requests to endpoints normally used by administrators
How to Mitigate CVE-2024-13232
Immediate Actions Required
- Update the WordPress Awesome Import & Export Plugin to a version later than 4.1.1 as soon as a fixed release is available from the vendor via CodeCanyon
- Disable the plugin on production sites until a patched version is confirmed installed
- Disable open user registration and set default_role to a value other than administrator
- Review the wp_users table and remove any unauthorized administrator accounts, then rotate credentials for all remaining administrators
Patch Information
The vendor distributes the plugin through CodeCanyon. Site owners should acquire the latest release from the official plugin listing and confirm that the fixed version enforces a capability check on renderImport(). Refer to the Wordfence advisory for the authoritative patched version number.
Workarounds
- Deactivate the plugin entirely until an updated version is installed
- Restrict access to wp-admin and admin-ajax.php by IP allowlist at the web server or WAF layer
- Apply WAF rules that block requests to the plugin's import handlers from users lacking the administrator role
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
