The WP All Export Pro plugin for WordPress contains a code injection vulnerability (CWE-94) due to improper validation and sanitization of user input. Authenticated attackers with Shop Manager privileges or higher can exploit this flaw to update arbitrary WordPress options, including changing the default registration role to administrator and enabling user registration. This leads to privilege escalation by allowing attackers to create administrative users on the affected site. The vulnerability affects all versions up to and including 1.9.1. The CVSS score is 6.8 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, and user interaction needed. There is no vendor advisory or patch information currently available.

Successful exploitation allows an authenticated user with Shop Manager-level access or above to escalate privileges to administrator by modifying site options. This can result in unauthorized administrative access, potentially compromising the entire WordPress site, including confidentiality, integrity, and availability of site data and functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager-level access to trusted users only and monitor for suspicious changes to site options related to user roles and registration settings. Avoid enabling user registration unless necessary and review plugin usage closely.