Security readout for executives and security teams
Plain-English summary
CVE-2024-7425 affects WP All Export Pro for WordPress through version 1.9.1. A user with Shop Manager-level access or higher may be able to change sensitive site options, potentially enabling registration and making new accounts administrators. This is not a remote unauthenticated issue, but it can turn a lower privileged account into full site control.
Executive priority
Treat this as a priority for WordPress sites where Shop Manager accounts are broadly delegated or externally exposed. It is not evidenced as actively exploited in the provided sources, but successful abuse can create administrator access and full site compromise.
Technical view
The source describes improper input validation and sanitization allowing authenticated Shop Manager+ users to update arbitrary WordPress options. Reported impact includes changing default registration role to administrator and enabling registration. CVSS 3.1 is 6.8 with high confidentiality, integrity, and availability impact, but high privileges and user interaction are required.
Likely exposure
Exposure is likely limited to WordPress sites running WP All Export Pro versions up to and including 1.9.1, where Shop Manager-level or higher accounts exist. Sites with many delegated ecommerce or content operators have higher practical exposure.
Exploitation context
The bundle does not show KEV listing or active exploitation evidence. Exploitation requires an authenticated Shop Manager-level or higher user and, per CVSS, user interaction. The main risk is privilege escalation after compromise or misuse of a privileged-but-non-admin account.
Researcher notes
The affected description is clear, but the source bundle does not name a fixed version or provide active exploitation evidence. The listed CWE is CWE-94, while the described behavior is arbitrary WordPress option modification leading to privilege escalation. Validate affected-version and remediation details against vendor advisory data.
Mitigation direction
- Identify WordPress sites running WP All Export Pro.
- Check whether installed versions are 1.9.1 or earlier.
- Review vendor and Wordfence guidance for a fixed release or workaround.
- Restrict Shop Manager-level access to trusted users only.
- Monitor sensitive WordPress options, especially registration and default role settings.
Validation and detection
- Confirm plugin name and version in each WordPress inventory.
- List accounts with Shop Manager-level access or higher.
- Review recent changes to user registration and default role options.
- Check for unexpected administrator accounts created after suspicious option changes.
- Document whether vendor guidance identifies an applicable fixed version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-7425 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H0.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.