title: WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE
description: The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
vendor: Unknown
product: Export any WordPress data to XML/CSV
versions:
status: affected, versionType: semver, version: 0, lessThan: 1.4.0
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}
{
vendor: Unknown
product: WP All Export Pro
versions:
status: affected, versionType: semver, version: 0, lessThan: 1.8.6
defaultStatus: unaffected
}
