WordPress Plugin Vulnerabilities

WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

Description

The plugin does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
wp-import-export-lite
Fixed in 3.9.33

References

CVE
CVE-2026-76551

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
1ad0c536-cebd-40d2-b6a9-48c5c76e972c

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2021-07-05
Title
Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE
Published
2026-09-04
Title
Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.22 - Unauthenticated Hook Injection
Published
2025-05-22
Title
TableOn < 1.0.6 - Unauthenticated Arbitrary Shortcode Execution
Published
2025-08-15
Title
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress < 4.16.5 - Unauthenticated Arbitrary Shortcode Execution
Published
2024-05-17
Title
ArForms < 6.6 - Unauthenticated RCE