CVE-2024-56278

WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability

9.1 CriticalPublic exploit

Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows PHP Remote File Inclusion.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.97%Up 1.9 points since Jan 8, 2025

What each source reports

CVE List Score used 9.1

WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability

Record: CVE-2024-56278
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2024-53075 9.1

Record: EUVD-2024-53075
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p3pp-r8w3-m3f7 9.1

Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders WP...

Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders WP Ultimate Exporter allows PHP Remote File Inclusion.This issue affects WP Ultimate Exporter: from n/a through 2.9.1.

Record: GHSA-p3pp-r8w3-m3f7
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 9.1

Record: CVE-2024-56278
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	DoTTak/CVE-2024-56278	2025-01-06

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-56278 is a critical vulnerability (CVSS 9.1) in Smackcoders Wp Ultimate Exporter, published January 7, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile. No source names a fixed version.