The WP All Import Pro plugin for WordPress suffers from a CSRF vulnerability (CWE-352) due to the absence of nonce validation on the delete_and_edit function. This flaw allows attackers to craft forged requests that, if executed by an authenticated site administrator, can delete imported content such as posts, comments, or users. The vulnerability affects all versions up to and including 4.9.7. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. No patch or official fix details are currently available.

An attacker can cause an authenticated administrator to unknowingly delete imported content by exploiting the CSRF vulnerability. This results in limited integrity impact (deletion of content) but no confidentiality or availability impact is indicated. The attack requires user interaction (administrator clicking a malicious link) and does not grant the attacker direct access or elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links and consider implementing additional CSRF protections or restricting administrative access to trusted networks. Monitoring for unusual deletion activity may help detect exploitation attempts.