CVE-2026-76559: WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-import-export-liteto a version that resolves this vulnerability.Fixed in 3.9.33 - Compensating control
Restrict outbound network access from the WordPress server (e.g., block requests from the WordPress host to internal IP ranges/localhost) to mitigate SSRF impact during/after import URL handling.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the plugin's import capability can exploit it. Administrators hold that capability by default, so sites are exposed where an administrator account is compromised or where that capability has been delegated.
What access does an attacker need?
The attacker must be able to use the import process and supply an import URL. They can then cause the WordPress site to request internal hosts or services and read the responses.
Which versions need remediation?
WP Import Export Lite versions before 3.9.33 are affected. Update to version 3.9.33 or later.
Is this related to an earlier vulnerability?
Yes. The issue is described as an incomplete fix for CVE-2026-11397.