CVE-2026-76556 — WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules

CVE-2026-76556

WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules PUBLISHED

Description (CNA)

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Import Export Lite	affected 0 before 3.9.33

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a8192a4e-4fea-423f-9d65-f9229f9b1922/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.