CVE-2026-76552
CVE-2026-76552
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)