CVE-2026-76554— WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import
Quick assessment
Affected
Unknown WP Import Export Lite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WP Import Export Lite WordPress 插件在 3.9.35 版本之前未验证执行导入操作的用户是否具备创建或修改用户账户以及分配角色的权限。这使得仅被授予 WP Import Export Lite 插件操作权限、但本无法管理用户的用户可以创建管理员账户，并覆盖现有账户（包括管理员）的凭证和角色。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76554
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Import Export Lite | 0 ~ 3.9.35 | - |
|
II. Public POCs for CVE-2026-76554
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76554
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-76554 (1)
-
🔗 WP Import Export Lite < 3.9.35 – Authenticated Privilege Escalation via User Import | CVE 2026-76554 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-19 · 21 CVEs total
| CVE-2026-91847 | Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection | |
| CVE-2025-15698 | Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting | |
| CVE-2026-19860 | JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validati | |
| CVE-2026-16557 | Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_con | |
| CVE-2026-84750 | Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-76790 | Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter | |
| CVE-2026-85574 | Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unb | |
| CVE-2026-85680 | Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title | |
| CVE-2026-86591 | Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder R | |
| CVE-2026-86814 | UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider | |
| CVE-2026-92435 | Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API | |
| CVE-2026-92099 | WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squ | |
| CVE-2026-88824 | Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings | |
| CVE-2026-88926 | VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi | |
| CVE-2026-92404 | MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure | |
| CVE-2026-92425 | Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR | |
| CVE-2026-92420 | Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR | |
| CVE-2026-92421 | Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR | |
| CVE-2026-92403 | Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Sub | |
| CVE-2026-92430 | Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webh |
IV. Related Vulnerabilities
Same product: WP Import Export Lite
-
CVE-2026-76558
WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS -
CVE-2026-76559
WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL -
CVE-2026-76551
WP Import Export Lite < 3.9.33 - Authenticated RCE via Expor -
CVE-2026-76553
WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Dir -
CVE-2026-76555
WP Import Export Lite < 3.9.33 - Authenticated Sensitive Fil
Same vendor: Unknown
-
CVE-2026-92435
Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken A -
CVE-2026-92430
Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order St -
CVE-2026-92403
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modifica -
CVE-2026-92421
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Tak -
CVE-2026-92420
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Delet
V. Comments for CVE-2026-76554
No comments yet