CVE-2026-76556 — WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users hold…
Published: 2026-09-16 · CVSS: 6.8 · CVSS 3.1
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7