EUVD-2026-80180
GHSA-fxvp-m8p8-32p6
Lifecycle Timeline
2DescriptionCVE.org
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
Analysis
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Import Export Lite
View allThe WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati
The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ fu
Server-Side Request Forgery in WP Import Export Lite (all versions ≤ 3.9.30) allows authenticated administrators to bypa
Deserialization of Untrusted Data vulnerability in VJInfotech WP Import Export Lite.9.26. Rated medium severity (CVSS 4.
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during t
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it a
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it re
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing expo
Share
External POC / Exploit Code
Leaving vuln.today