CVE-2026-76555: WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have a WordPress account with a role that an administrator has explicitly granted the plugin's import permission. It is not described as exploitable by unauthenticated visitors or by users without that permission.
What access does an attacker need to obtain sensitive files?
The attacker needs to be able to supply a file path through the plugin's import functionality. The vulnerable code can read that path and copy the file into a publicly accessible directory, including when the source file is outside the web root.
Are default WordPress user roles necessarily affected?
The available information does not identify any default role as having the required import permission. Exposure depends on which roles an administrator has granted the WP Import Export Lite import permission.
What is the impact if copying the targeted file fails?
The same code path may relax filesystem permissions on any supplied path even if the file copy does not succeed. This can create an additional security concern beyond disclosure of files successfully copied to the public directory.
How can administrators assess whether they are exposed?
Check whether WP Import Export Lite is running a version earlier than 3.9.33 and review which WordPress roles have been granted its import permission. Accounts assigned to those roles can potentially invoke the affected import path.