WordPress WP Import Export Lite plugin < 3.9.35 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.35...

CVE-2026-76554

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554

The WP Import Export Lite WordPress plugin (versions before 3.9.35 ) is vulnerable to an authenticated privilege escalation due to improper privilege management. The plugin fails to verify if a user running an import is authorized to create or modify user accounts and assign roles. This allows us...

CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

EUVD-2026-83500

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554: Improper Privilege Management

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

PT-2026-95753

Name of the Vulnerable Software and Affected Versions WP Import Export Lite WordPress plugin versions prior to 3.9.35 Description The plugin fails to verify if the user performing an import has the necessary permissions to create or modify user accounts and assign roles. This allows users with...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Arbitrary Directory Deletion vulnerability

Authenticated Arbitrary Directory Deletion vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated RCE vulnerability

Authenticated RCE vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.34 - Authenticated RCE vulnerability

Authenticated RCE vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.34...

CVE-2026-76553

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-76552

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

CVE-2026-76556

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

CVE-2026-76559

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-76551

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

CVE-2026-76559 WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

WordPress WP Import Export Lite plugin < 3.9.33 - Contributor+ Stored DOM XSS vulnerability

Contributor+ Stored DOM XSS vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...