CVE-2026-76554: unknown wp import export lite Improper Privilege Management

Vulnerability summary

CVE-2026-76554 is a high (CVSS 7.2) Improper Privilege Management vulnerability in unknown wp import export lite. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.6% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.9.35.

Timeline

1. 19-09-2026
   PublishedVulnerability first disclosed.
2. 19-09-2026
   Last modifiedVulnerability information updated.

Description

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.