high8.8
CVE-2026-76552
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during…
Impact
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
Affected products
| Product | Affected versions |
|---|---|
| WP Import Export Lite WordPress Plugin | before 3.9.33 |
Versions were read from the advisory text. No structured product data has been published for this record yet.