CVE-2026-76555— WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
Quick assessment
Affected
Unknown WP Import Export Lite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WP Import Export Lite WordPress 插件在 3.9.33 版本之前，在读取用户提供的文件路径并将其复制到公开可访问目录之前，未对该路径进行充分验证。这允许任何被管理员授予该插件导入权限的用户，从服务器中泄露敏感文件，包括位于 Web 根目录之外的文件。此外，无论文件复制是否成功，该代码路径还会放宽所给定文件路径的文件系统权限。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory DiscoveryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Import Export Lite | < 3.9.33 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76555
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Import Export Lite | 0 ~ 3.9.33 | - |
|
II. Public POCs for CVE-2026-76555
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76555
请登录查看更多情报信息。
Other References for CVE-2026-76555 (1)
-
🔗 WP Import Export Lite < 3.9.33 – Authenticated Sensitive File Disclosure via Existing File Import Path Traversal | CVE 2026-76555 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-16 · 46 CVEs total
| CVE-2026-13407 | 6.1 MEDIUM | Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notifica |
| CVE-2026-84906 | 5.3 MEDIUM | Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transa |
| CVE-2026-86475 | 5.3 MEDIUM | Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appo |
| CVE-2026-19857 | 4.8 MEDIUM | Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Cu |
| CVE-2026-76558 | WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names | |
| CVE-2026-85349 | FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR | |
| CVE-2026-76553 | WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template P | |
| CVE-2026-76557 | WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options | |
| CVE-2026-76551 | WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function | |
| CVE-2026-74926 | MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via | |
| CVE-2026-76556 | WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules | |
| CVE-2026-82124 | Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Con | |
| CVE-2026-77702 | Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token | |
| CVE-2026-84829 | Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter | |
| CVE-2026-84905 | Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation | |
| CVE-2026-84088 | Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget | |
| CVE-2026-82126 | Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content D | |
| CVE-2026-82125 | Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Con | |
| CVE-2026-84907 | Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoi | |
| CVE-2026-76550 | WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WP Import Export Lite
-
CVE-2026-76559
WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL -
CVE-2026-76558
WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS -
CVE-2026-76556
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Expo -
CVE-2026-76551
WP Import Export Lite < 3.9.33 - Authenticated RCE via Expor -
CVE-2026-76553
WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Dir
Same vendor: Unknown
-
CVE-2026-87831
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-87829
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-91017
Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthen -
CVE-2026-86801
To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, Fi -
CVE-2026-87963
Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username
V. Comments for CVE-2026-76555
No comments yet