WordPress Plugin Vulnerabilities

WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal

Description

The plugin does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
wp-import-export-lite
Fixed in 3.9.34

References

CVE
CVE-2026-76550

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
7.2 (high)

Miscellaneous

Original Researcher
mak3bread(Minseong Kim)
Submitter
mak3bread(Minseong Kim)
Verified
Yes
WPVDB ID
d739fefd-cc21-49ce-90a1-b16c159e9389

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-15 (about 7 hours ago)

Other

Published
Title
Published
2026-02-16
Title
Modal Dialog < 3.5.17 - Authenticated (Admin+) Remote Code Execution
Published
2025-04-03
Title
TagDiv Composer < 5.4 - Unauthenticated Arbitrary PHP Object Instantiation
Published
2018-11-20
Title
Yoast SEO <= 9.1 - Authenticated Race Condition
Published
2023-09-05
Title
Media Library Assistant < 3.10 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
Published
2025-10-31
Title
Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution