CVE-2026-76552

Description

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.

References

• https://wpscan.com/vulnerability/e858099a-c3ce-453d-9b98-75087dddc381/