EUVD-2026-80177
GHSA-mq5q-9p83-hr98
Lifecycle Timeline
2DescriptionCVE.org
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
Analysis
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Import Export Lite
View allThe WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati
The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ fu
Server-Side Request Forgery in WP Import Export Lite (all versions ≤ 3.9.30) allows authenticated administrators to bypa
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.9.26. Rated medium severity (CVSS 4.
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during t
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it a
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing expo
Share
External POC / Exploit Code
Leaving vuln.today