CVE-2024-32431: WP All Import Deserialization Vulnerability

CVE-2024-32431 Overview

CVE-2024-32431 is a PHP Object Injection vulnerability in the WordPress plugin Import Users from CSV by WP All Import. The flaw stems from insecure deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 1.2. An authenticated attacker with high privileges on the target WordPress site can supply crafted serialized input that the plugin unserializes without validation. Successful exploitation can lead to arbitrary code execution, data tampering, or full site compromise when a suitable PHP object gadget chain is present in the WordPress environment.

Critical Impact
Authenticated attackers can trigger PHP object injection through the plugin's CSV import functionality, potentially leading to remote code execution and full compromise of the WordPress instance.

Affected Products

WP All Import — Import Users from CSV plugin, versions up to and including 1.2
WordPress sites running the vulnerable plugin
Any WordPress deployment where high-privileged accounts can access the import functionality

Discovery Timeline

2024-04-15 - CVE-2024-32431 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32431

Vulnerability Analysis

The vulnerability is an Insecure Deserialization flaw classified under [CWE-502]. The Import Users from CSV plugin processes serialized PHP data supplied through the import workflow and passes it to unserialize() without sanitizing or validating the input. When PHP deserializes attacker-controlled data, magic methods such as __wakeup(), __destruct(), and __toString() can be invoked on reconstructed objects. If a suitable gadget chain exists in the loaded WordPress code base — including core, themes, or other plugins — an attacker can chain these method calls to reach dangerous sinks such as file writes, arbitrary command execution, or SQL manipulation. Exploitation requires high privileges but no user interaction, and the attack is delivered over the network through the standard WordPress admin interface.

Root Cause

The root cause is the plugin's use of PHP's native unserialize() function on data that originates from user-controlled sources. The plugin does not implement allow-listing of expected classes, does not validate structure before deserialization, and does not use safer alternatives such as JSON decoding. This allows arbitrary PHP object instantiation during the import operation.

Attack Vector

An authenticated user with administrative privileges submits a crafted payload through the plugin's CSV import interface. The payload contains a serialized PHP object referencing a class present in the WordPress runtime. When the plugin deserializes the payload, PHP reconstructs the object and invokes its magic methods, triggering the gadget chain. Because the plugin operates within the WordPress admin context, code execution occurs with the privileges of the web server user, enabling persistence, credential theft, and lateral movement.

No verified public proof-of-concept code has been released. Technical details are available in the Patchstack Vulnerability Analysis.

Detection Methods for CVE-2024-32431

Indicators of Compromise

Unexpected PHP files or web shells written under wp-content/uploads/ or plugin directories following a CSV import event
WordPress admin logs showing CSV import actions from unusual IP addresses or at atypical times
Serialized PHP payloads (strings beginning with O: or a:) appearing in HTTP POST bodies to admin.php or admin-ajax.php
New administrator accounts or unauthorized modifications to wp_users and wp_usermeta tables

Detection Strategies

Inspect web server access logs for POST requests to the plugin's import endpoints containing PHP serialization markers
Monitor the WordPress plugin registry for installations of Import Users from CSV at version 1.2 or earlier
Deploy file integrity monitoring on the WordPress webroot to detect unauthorized file creation or modification

Monitoring Recommendations

Enable WordPress audit logging to capture administrative actions, especially plugin import operations
Forward web server and PHP error logs to a centralized log platform for correlation and retention
Alert on outbound network connections initiated by the PHP-FPM or web server process to unexpected destinations

How to Mitigate CVE-2024-32431

Immediate Actions Required

Identify all WordPress sites running Import Users from CSV and confirm the installed version
Update the plugin to a version released after 1.2 that contains the vendor fix
Restrict administrative access to trusted users and enforce multi-factor authentication on all privileged WordPress accounts
Review recent CSV import activity and audit user tables for unauthorized changes

Patch Information

Users should upgrade to the latest available version of the Import Users from CSV plugin from the WordPress plugin repository. Refer to the Patchstack Vulnerability Analysis for the current remediation guidance and fixed version details.

Workarounds

Deactivate and remove the plugin if it is not actively required for business operations
Place the WordPress admin interface behind an IP allow list or VPN to reduce the attack surface
Deploy a web application firewall rule that blocks HTTP request bodies containing PHP serialized object patterns targeting the plugin endpoints

bash

# Example WAF pattern to block serialized PHP object payloads to admin endpoints
# ModSecurity rule (illustrative)
SecRule REQUEST_URI "@rx /wp-admin/(admin\.php|admin-ajax\.php)" \
  "chain,phase:2,deny,status:403,id:1002024032431,msg:'Possible PHP object injection payload'"
  SecRule REQUEST_BODY "@rx O:[0-9]+:\"[A-Za-z_][A-Za-z0-9_]*\":[0-9]+:" \
    "t:none,t:urlDecode"