CVE-2024-32817

The Import and export users and customers plugin for WordPress through version 1.26.2 contains a PHP Object Injection vulnerability caused by unsafe deserialization in the import.php file. Authenticated users with administrator privileges or higher can exploit this to inject malicious PHP objects. While the plugin itself lacks a gadget chain to achieve immediate code execution, the presence of such a chain in other installed plugins or themes could enable attackers to delete files, access sensitive information, or run arbitrary code.

Based on public CVE data (MITRE/NVD).