CVE-2024-9664: Soflyy WP All Import RCE Vulnerability

CVE-2024-9664 Overview

CVE-2024-9664 is a PHP Object Injection vulnerability in the WP All Import Pro plugin for WordPress. The flaw affects all versions up to and including 4.9.7. It stems from deserialization of untrusted input contained in import files [CWE-502]. Authenticated attackers with Administrator-level access or higher can inject a PHP object into the application. The vulnerable code alone does not contain a Property-Oriented Programming (POP) chain. However, if a POP chain exists in another installed plugin or theme, attackers can delete arbitrary files, exfiltrate sensitive data, or execute arbitrary code on the WordPress host.

Critical Impact
Authenticated administrators can trigger PHP object injection through malicious import files, enabling arbitrary file deletion, data disclosure, or remote code execution when a POP chain is available on the target site.

Affected Products

Soflyy WP All Import Pro for WordPress — all versions up to and including 4.9.7
WordPress sites running the affected plugin with additional plugins or themes that contain exploitable POP chains
CPE: cpe:2.3:a:soflyy:wp_all_import:*:*:*:*:pro:wordpress:*:*

Discovery Timeline

2025-02-07 - CVE-2024-9664 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9664

Vulnerability Analysis

WP All Import Pro processes uploaded import files and passes untrusted data through PHP deserialization routines. When a serialized PHP object is present in the import file, the plugin instantiates the object without validating its class or contents. This behavior maps to CWE-502, Deserialization of Untrusted Data. The plugin itself does not ship a usable POP chain, so direct code execution requires a gadget chain from another component installed on the same WordPress instance. Because WordPress sites commonly stack many plugins and themes, the presence of a suitable gadget is realistic in production environments.

Root Cause

The root cause is the use of PHP deserialization on attacker-controlled content inside import files. The plugin trusts data supplied by an authenticated administrator and reconstructs PHP objects through unserialize()-style processing. No allow-list of expected classes and no integrity check on the serialized payload are enforced before object reconstruction.

Attack Vector

Exploitation requires an authenticated account with Administrator privileges or higher on the target WordPress site. The attacker crafts an import file containing a serialized PHP object referencing classes exposed by other plugins or themes. Uploading and processing the file through the WP All Import Pro workflow triggers deserialization. If a matching magic method (for example __destruct, __wakeup, or __toString) exists in an installed component, the injected object drives that gadget chain toward file deletion, information disclosure, or arbitrary code execution. Refer to the Wordfence advisory for CVE-2024-9664 for additional technical context.

Detection Methods for CVE-2024-9664

Indicators of Compromise

Import files uploaded to WP All Import Pro that contain serialized PHP object markers such as O: or a: sequences followed by class names.
Unexpected creation, modification, or deletion of files under the WordPress installation directory shortly after an import job runs.
New administrator accounts, PHP files in wp-content/uploads/, or modifications to wp-config.php following plugin activity.
Outbound network connections originating from the PHP worker process during or immediately after an import operation.

Detection Strategies

Inventory WordPress installations and identify sites running WP All Import Pro at version 4.9.7 or earlier.
Inspect the plugin's import logs and staged files for serialized payloads that reference classes from other plugins or themes.
Correlate administrator login events with subsequent import activity to surface abuse of privileged accounts.
Enable PHP error and audit logging to capture deserialization errors, unexpected class instantiation, or fatal errors during imports.

Monitoring Recommendations

Alert on writes to sensitive WordPress paths such as wp-config.php, wp-content/plugins/, and wp-content/mu-plugins/ following import jobs.
Monitor web server access logs for POST requests to WP All Import endpoints from unusual IP addresses or user agents.
Track administrator session creation, especially from new geolocations, to detect credential compromise that precedes exploitation.

How to Mitigate CVE-2024-9664

Immediate Actions Required

Update WP All Import Pro to a version later than 4.9.7 as soon as the vendor patch is available from wpallimport.com.
Audit all WordPress administrator accounts and remove or disable unused privileged users.
Enforce multi-factor authentication for every account with the Administrator role or higher.
Review installed plugins and themes and remove components that are unmaintained or unnecessary, reducing the pool of potential POP chains.

Patch Information

The vulnerability affects WP All Import Pro through version 4.9.7. Administrators should apply the vendor-supplied update that follows 4.9.7 and confirm the version reported by the WordPress plugins page. Consult the Wordfence advisory for fixed-version tracking.

Workarounds

Restrict access to the WP All Import interface using web server rules or a WordPress access control plugin until patching completes.
Disable or uninstall WP All Import Pro on sites where imports are not actively required.
Place the site behind a web application firewall configured to inspect and block serialized PHP payloads in uploads.
Limit filesystem permissions on the PHP worker account so that arbitrary file deletion or overwrite requires additional privileges.

bash

# Configuration example: block requests containing PHP serialized objects
# using an ModSecurity-style rule at the web server
SecRule ARGS|REQUEST_BODY "@rx O:[0-9]+:\"[A-Za-z_\\\\]+\":[0-9]+:\{" \
    "id:1009664,phase:2,deny,status:403,log,\
    msg:'Possible PHP object injection payload (CVE-2024-9664)'"