← CVE Intelligence

CVE-2026-76552

WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import PUBLISHED

Description (CNA)

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.

Affected (CNA)

Vendor / productVersions
Unknown / WP Import Export Liteaffected 0 before 3.9.33

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.