CVE-2026-76553: WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Import Export Lite WordPress pluginto a version that resolves this vulnerability.Fixed in 3.9.33 - Compensating control
Restrict/limit delegated capabilities for the WP Import Export Lite WordPress plugin so non-administrator users do not gain authority to exploit the authenticated arbitrary directory deletion (e.g., remove unnecessary delegated permissions).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated user who has been delegated a WP Import Export Lite capability by an administrator. It is not described as exploitable by unauthenticated visitors.
What systems are affected?
WP Import Export Lite versions before 3.9.33 are affected. The vulnerable deletion can target directories outside the web root as well as files within those directories.
What is the impact of successful exploitation?
A permitted plugin user can use a path from stored user-supplied data to cause recursive deletion of an arbitrary resolved directory and all files it contains.