The vulnerability CVE-2024-13232 affects the WordPress Awesome Import & Export Plugin - Import & Export WordPress Data, where the renderImport() function lacks proper capability checks. This missing authorization allows authenticated users with low-level privileges (Subscriber and above) to perform arbitrary SQL execution. Exploiting this flaw can enable attackers to escalate privileges by creating new administrative users, compromising the integrity and control of the WordPress site. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

An attacker with authenticated access at Subscriber level or higher can execute arbitrary SQL commands on the affected WordPress plugin, potentially leading to privilege escalation by creating new administrative accounts. This compromises site security by allowing unauthorized administrative control, impacting confidentiality, integrity, and availability of the WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor or WordPress plugin repository to apply any forthcoming patches promptly.