CVE-2026-76555 in WP Import Export Lite Plugin
Summary
by MITRE • 09/16/2026
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in WP Import Export Lite versions prior to 3.9.33 represents a critical security flaw rooted in improper input validation and insecure direct object reference mechanisms. The core technical issue lies within the plugin's file import functionality, which fails to adequately sanitize or validate user-supplied file paths before processing them. This lack of rigorous path traversal prevention allows an attacker to manipulate the intended destination directory by utilizing standard directory traversal sequences such as dot-dot-slash characters. By exploiting this weakness, a malicious actor can redirect the copy operation from the designated public upload folder to arbitrary locations on the server's filesystem.
This flaw has severe operational implications for WordPress site integrity and data confidentiality. Specifically, it enables any user who possesses the import permission granted by an administrator to read sensitive files stored outside the web root. This capability effectively bypasses standard web server security boundaries that typically restrict access to directories not intended for public viewing. Consequently, attackers can exfiltrate configuration files containing database credentials, private keys, environment variables, and other proprietary data essential for further exploitation or lateral movement within the infrastructure. The ability to disclose these sensitive resources compromises the confidentiality of the entire application ecosystem dependent on this WordPress installation.
Furthermore, the vulnerability extends beyond simple file disclosure due to a secondary flaw in how the plugin handles filesystem permissions during the import process. The code path responsible for copying files also relaxes the file-system permissions of any target path provided by the user, regardless of whether the copy operation ultimately succeeds or fails. This behavior can inadvertently grant broader access rights than intended to specific directories or files on the server. Such permission relaxation may facilitate additional attack vectors where previously restricted resources become accessible to lower-privileged users or processes, thereby escalating the potential impact from mere data disclosure to full system compromise depending on the underlying operating system configuration and user privileges associated with the web server process.
From a classification perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which covers issues where software does not properly neutralize special elements within file paths that can resolve to directories outside of the intended restricted directory. Additionally, it relates to CWE-732: Incorrect Permission Assignment for Critical Resource, reflecting the dangerous side effect of relaxing filesystem permissions without adequate validation or context awareness. In terms of offensive security frameworks like MITRE ATT&CK, this behavior supports techniques associated with Discovery and Collection phases, specifically allowing adversaries to gather sensitive information from local system resources through unauthorized access mechanisms.
To mitigate these risks, immediate action is required by updating the WP Import Export Lite plugin to version 3.9.33 or later where these validation checks have been strengthened. Administrators should ensure that all plugins are kept up-to-date with security patches released by their vendors. In environments where updates cannot be applied immediately, it is advisable to restrict import permissions strictly to trusted users and monitor server logs for unusual file access patterns indicative of path traversal attempts. Implementing strict web application firewall rules can also help block common directory traversal payloads before they reach the vulnerable code paths within the plugin logic.