CVE-2026-76551: WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

Q: What level of access is required to exploit this issue?

An attacker needs an authenticated WordPress account that has been granted the plugin's export permission. They must also be able to control values processed by an export field.

Q: Which installations are affected?

WP Import Export Lite versions earlier than 3.9.33 are affected. Update the plugin to version 3.9.33 or later.

Q: What can be done if the plugin cannot be updated immediately?

Remove or restrict the plugin's export permission for untrusted users. The described exploitation path depends on the attacker having that permission.

Published Sep 16, 2026

Updated

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress plugin: WP Import Export Lite to a version that resolves this vulnerability.
Fixed in 3.9.33

Event History

Sep 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What level of access is required to exploit this issue?

An attacker needs an authenticated WordPress account that has been granted the plugin's export permission. They must also be able to control values processed by an export field.

Which installations are affected?

WP Import Export Lite versions earlier than 3.9.33 are affected. Update the plugin to version 3.9.33 or later.

What can be done if the plugin cannot be updated immediately?

Remove or restrict the plugin's export permission for untrusted users. The described exploitation path depends on the attacker having that permission.