CVE-2026-76550: unknown wp import export lite Code Injection

Vulnerability summary

CVE-2026-76550 is a high (CVSS 7.2) Code Injection vulnerability in unknown wp import export lite. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.9.34.

Timeline

1. 16-09-2026
   PublishedVulnerability first disclosed.
2. 17-09-2026
   Last modifiedVulnerability information updated.

Description

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.