Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2026-76555: WP Import Export Lite allows admin to expose server files
CVE-2026-76555 · published 1 month ago
Summary
The WP Import Export Lite plugin for WordPress lets anyone who has been given its import permission read any file on the server and copy it to a location that anyone can view, even files outside the website folder. This can reveal confidential information such as configuration files or private data. Update the plugin to the latest version or remove it, and make sure only trusted users have the import capability.
What to do
- Update unknown wp import export lite to version 3.9.33 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | wp import export lite | < 3.9.33 |
Original advisory text
WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.8
Medium
Type
CWE-22Path Traversal
Timeline
Published16 Sep 2026
Updated4 Nov 2026
First seen16 Sep 2026
Track software like this
Free during beta