CVE-2026-76556: WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user must hold the plugin's export permission. Administrators have that permission by default, and lower-privileged roles may be exposed if they have been granted it.
Are default WordPress installations exposed to unauthenticated attack?
No unauthenticated exploitation is indicated. The issue requires an authenticated user with the plugin's export permission; administrators have this permission by default.
What should be checked while patching is pending?
Review which accounts and roles have the plugin's export permission, particularly any non-administrator roles. Restrict that permission to trusted users until the plugin is updated to version 3.9.33 or later.