CVE-2026-76551 — WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

CVE-2026-76551

WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function PUBLISHED

Description (CNA)

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Import Export Lite	affected 0 before 3.9.33

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1ad0c536-cebd-40d2-b6a9-48c5c76e972c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.