EUVD-2026-80178
GHSA-j4q7-794x-44pp
Lifecycle Timeline
2DescriptionCVE.org
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
Analysis
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Import Export Lite
View allThe WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati
The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ fu
Server-Side Request Forgery in WP Import Export Lite (all versions ≤ 3.9.30) allows authenticated administrators to bypa
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.9.26. Rated medium severity (CVSS 4.
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during t
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it a
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it re
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing expo
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today