CVE-2026-76550: WP Import Export Lite RCE Vulnerability

CVE-2026-76550 Overview

CVE-2026-76550 affects the WP Import Export Lite WordPress plugin in versions prior to 3.9.34. The plugin fails to validate a user-supplied output path when writing export files. Users granted the plugin's export permission can write files with arbitrary names to arbitrary locations on the server. Attackers leverage this behavior to place executable PHP files inside web-accessible directories, resulting in remote code execution. The flaw maps to CWE-94 (Improper Control of Generation of Code).

Critical Impact
Authenticated users with export privileges can achieve remote code execution on the underlying WordPress host, compromising site integrity, data confidentiality, and availability.

Affected Products

WP Import Export Lite WordPress plugin versions before 3.9.34
WordPress sites granting the plugin's export capability to non-administrator roles
Any hosting environment where the WordPress wp-content directory is writable by the PHP process

Discovery Timeline

2026-09-16 - CVE-2026-76550 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76550

Vulnerability Analysis

The WP Import Export Lite plugin exposes an export workflow that accepts a destination path for the generated export file. The plugin writes attacker-controlled content to a location derived from that path without validating the target directory or file extension. An authenticated user holding the export capability can direct the plugin to write a .php file under wp-content/uploads/ or another web-served directory. Requesting the resulting URL executes the attacker's PHP payload under the web server user context.

Because the sink writes fully controlled bytes to a fully controlled path, the primitive is a direct authenticated arbitrary file write escalating to code execution. See the WPScan Vulnerability Report for further technical details.

Root Cause

The plugin trusts a user-supplied output path parameter passed to its export handler. It does not enforce an allowlisted directory, does not normalize path traversal sequences, and does not restrict the output file extension. This absence of validation allows the caller to pivot from writing a benign export artifact to dropping arbitrary server-side code.

Attack Vector

Exploitation requires an authenticated session with the plugin's export permission. The attacker submits an export request containing a crafted output path and payload content. The plugin writes the payload to the requested location. The attacker then issues an HTTP request to the newly created file to trigger PHP execution, obtaining code execution as the web server user.

// Example exploitation flow (described in prose - no verified PoC published)
// 1. Authenticate as a user with plugin export permission
// 2. Submit an export request with an output path pointing to a
//    web-accessible directory and a .php extension
// 3. Include PHP payload content in the export data
// 4. Request the written file over HTTP to execute the payload

Detection Methods for CVE-2026-76550

Indicators of Compromise

Unexpected .php files appearing under wp-content/uploads/, wp-content/plugins/wp-import-export-lite/, or other non-standard write locations
Export requests to plugin AJAX or admin endpoints containing path traversal sequences such as ../ or absolute paths
Web server access logs showing GET requests to newly created PHP files immediately after plugin export activity

Detection Strategies

Monitor WordPress audit logs for export actions performed by non-administrator accounts with the plugin's export capability
Alert on file creation events where the WordPress PHP process writes files with executable extensions outside the plugin's expected temporary directories
Inspect HTTP POST bodies to plugin export endpoints for output path parameters containing traversal characters or writable web paths

Monitoring Recommendations

Enable file integrity monitoring across the WordPress webroot and alert on new PHP files under wp-content/uploads/
Correlate authenticated plugin activity with subsequent web requests to newly written files to identify write-then-execute patterns
Forward WordPress and web server logs to a centralized analytics platform for retention and cross-source correlation

How to Mitigate CVE-2026-76550

Immediate Actions Required

Upgrade WP Import Export Lite to version 3.9.34 or later on every WordPress instance
Audit user roles and revoke the plugin's export capability from any account that does not require it
Review the WordPress filesystem for unauthorized PHP files created since the plugin was installed and remove them
Rotate WordPress administrator and database credentials if compromise is suspected

Patch Information

The vendor addressed the missing output path validation in WP Import Export Lite version 3.9.34. Upgrading to this release or later removes the arbitrary file write primitive. Confirm the installed version in the WordPress plugins screen and validate the patch across staging and production environments. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the WP Import Export Lite plugin until the patched version is deployed
Restrict the plugin's export capability to trusted administrators using a role management plugin
Configure the web server to deny PHP execution inside wp-content/uploads/ and other user-writable directories

bash

# Example nginx configuration snippet denying PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}