CVE-2026-76552: WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account that has been granted the plugin's import permission. The issue is not described as exploitable by unauthenticated visitors.
What does the attacker need to provide?
The attacker supplies a URL during an import. The plugin retrieves the file from that URL without validating its type, extension, or contents.
What is the potential impact?
A permitted user can cause arbitrary files, including executable files, to be stored on the server. This can lead to remote code execution.
Which plugin versions are affected?
WP Import Export Lite versions before 3.9.33 are affected.