CVE-2026-76552 — WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing …
Published: 2026-09-16 · CVSS: 8.8 · CVSS 3.1
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7