CVE-2026-76550 in WP Import Export Lite Plugin
Summary
by MITRE • 09/16/2026
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in WP Import Export Lite versions prior to 3.9.34 represents a critical security flaw rooted in improper input validation and insecure file handling practices within the WordPress ecosystem. This specific weakness allows authenticated users who possess export permissions to manipulate the destination path for generated archive files, thereby bypassing intended directory restrictions. The core technical failure lies in the plugin's inability to sanitize or validate user-supplied output paths before utilizing them in filesystem operations. By accepting arbitrary strings as file destinations without enforcing strict adherence to expected directories, the application creates a direct pathway for attackers to write content outside of the designated upload folders. This lack of path validation is particularly dangerous because it transforms what appears to be a standard administrative function into a mechanism for unauthorized file system access and potential code execution.
From an operational perspective, this flaw enables remote code execution under specific conditions where the attacker can control both the filename and its location on the server's filesystem. If an attacker manages to write a PHP script or another executable payload to a directory that is accessible via HTTP, such as the wp-content/uploads folder or other web-accessible paths, they gain the ability to execute arbitrary code with the privileges of the web server process. This scenario typically requires the victim user to have at least contributor-level access within WordPress, which is often granted broadly in multi-author sites. The impact extends beyond simple data leakage; successful exploitation allows for complete compromise of the underlying hosting environment, including potential lateral movement to other services running on the same host or extraction of sensitive database credentials and configuration files stored alongside web content.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where software does not properly neutralize path sequences that can resolve to a parent directory or other location outside the intended restricted directory. Additionally, it relates to CWE-434: Unrestricted Upload of File with Dangerous Type if the attacker successfully uploads executable content, and CWE-94: Improper Control of Generation of Code (Code Injection) when the uploaded file is executed by the web server. In terms of tactical mapping within the MITRE ATT&CK framework for Enterprise, this exploit technique falls under T1505.003: Web Shell, as it facilitates the placement and execution of malicious scripts on a compromised system to maintain persistent access or perform further reconnaissance activities against internal network resources.
Mitigation strategies must prioritize immediate patching by upgrading WP Import Export Lite to version 3.9.34 or later, where these path validation checks have been implemented. For organizations unable to update immediately due to compatibility constraints, temporary workarounds should include restricting file upload permissions at the web server level using tools like ModSecurity rules that block write operations to non-standard directories for specific user agents associated with vulnerable plugins. Furthermore, implementing strict Content Security Policy headers and disabling PHP execution in writable directories such as uploads can significantly reduce the risk of successful code execution even if a malicious file is written to disk. Regular auditing of installed WordPress plugins and enforcing principle of least privilege by limiting export capabilities only to trusted administrators are essential long-term defensive measures against this class of vulnerabilities.