CVE-2026-76552 - WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import · CoreCVE

Back Back to CVE browser

HIGH

WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import

Published Sep 16, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.73%

Description

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.

Affected products

Vendor n/a Product WP Import Export Lite Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.9.33

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

WP Import Export Lite

unaffected

Version	Status	Constraints
0	affected	<3.9.33

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (1)

https://wpscan.com/vulnerability/e858099a-c3ce-453d-9b98-75087dddc381/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/e858099a-c3ce-453d-9b98-75087dddc381/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 16, 2026

Updated Sep 17, 2026

Reserved Aug 19, 2026

Link CVE-2026-76552

CISA Vulnrichment

Updated Sep 17, 2026

Status Deferred

Modified Sep 17, 2026

Link CVE-2026-76552

Severity n/a

Public date n/a

Links CVE-2026-76552