WP Import Export Lite CVE-2026-76554

Exploitation requires an authenticated WordPress user who has been granted the WP Import Export Lite import permission but is NOT otherwise permitted to manage users (e.g., a delegated editor or manager role). The attacker uses the plugin's user-import functionality, which fails to verify user-management/role-assignment capability, to create or overwrite accounts including administrators. Limiting factors: the site must actually delegate the import capability to a non-admin role (default WordPress installs restrict import to administrators, in which case the flaw yields no escalation); no user interaction from a victim is needed, and the plugin must be at a version before 3.9.35.

This is a genuine high-priority privilege-escalation flaw despite requiring some authentication. The CVSS 7.2 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full CIA compromise, and the impact is unambiguous: an attacker can mint administrator accounts and overwrite existing admin credentials/roles, which equals total site takeover. Publicly available exploit code exists (WPScan), raising real-world exploitability, though there is no CISA KEV listing and no EPSS score provided - so there is no evidence of active or widespread exploitation, only demonstrated feasibility. I dispute the vendor's PR:H: the vulnerability's entire premise is that a NON-admin user (granted only the delegated import permission and explicitly unable to manage users) escalates to admin - if the attacker were already admin-equivalent (PR:H), the escalation would be meaningless. PR:L is more accurate, which would raise the real severity. Bottom line: real priority for any site that delegates the plugin's import capability to non-admin roles; the limiting factor is that the attacker must first hold that delegated import permission.

A WordPress site admin delegates the WP Import Export Lite import capability to a mid-level user (e.g., an editor or shop manager) who cannot otherwise manage users. That user runs an import containing crafted user records, and because the import routine never checks user-management capability, it creates a new administrator account (or overwrites an existing admin's credentials and role), handing the attacker full control. Public exploit details are available via WPScan.