CVE-2026-76551: WP Import Export Lite RCE Vulnerability

CVE-2026-76551 Overview

CVE-2026-76551 affects the WP Import Export Lite WordPress plugin in versions before 3.9.33. The plugin fails to restrict which PHP functions can be applied to exported field values. Users granted export permission can invoke arbitrary PHP functions on values they control, resulting in remote code execution on the underlying web server. The flaw is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated users with export permission can execute arbitrary PHP code on the WordPress host, leading to full site compromise and potential lateral movement into the hosting environment.

Affected Products

WP Import Export Lite WordPress plugin versions prior to 3.9.33
WordPress installations granting the plugin's export permission to non-administrator roles
Any hosting environment running vulnerable versions of the plugin

Discovery Timeline

2026-09-16 - CVE-2026-76551 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76551

Vulnerability Analysis

The WP Import Export Lite plugin provides functionality to transform field values during export operations by applying PHP callback functions. The plugin does not maintain an allowlist of safe callbacks and does not validate that the requested function is appropriate for data transformation. As a result, any callable PHP function can be invoked at export time, including functions such as system, exec, passthru, or assert.

An attacker with an account that holds the plugin's export permission supplies both the function name and the argument. The plugin then invokes the attacker-chosen function against the attacker-controlled value. This behavior collapses the boundary between data serialization and code execution.

Root Cause

The root cause is improper control of code generation [CWE-94]. The plugin treats a user-supplied string as a trusted PHP callable and passes it to a dynamic invocation primitive such as call_user_func. Without an allowlist, deny-list, or type validation, the export routine becomes a general-purpose code execution primitive for any user holding the export role.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account with export privileges. The attacker triggers an export operation and supplies a malicious function name together with a payload argument. The plugin invokes the function server-side, executing the attacker's code in the context of the PHP worker process. No user interaction is required beyond the attacker's own authenticated request.

A sanitized proof of concept is not published. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-76551

Indicators of Compromise

Unexpected outbound network connections originating from the PHP worker or web server process
New or modified PHP files under wp-content/uploads/ or plugin directories following an export event
WordPress audit log entries showing export operations initiated by low-privilege accounts
Web server access logs containing POST requests to WP Import Export Lite export endpoints with unusual function-name parameters

Detection Strategies

Inventory WordPress installations and confirm the installed version of WP Import Export Lite against 3.9.33
Hunt for PHP process spawning shell interpreters (sh, bash, cmd.exe) as a child of the web server
Correlate export requests with subsequent file writes into web-accessible directories
Review role assignments for the plugin's export capability and flag non-administrator grants

Monitoring Recommendations

Enable WordPress activity logging with capture of plugin-specific administrative actions
Forward web server, PHP-FPM, and WordPress logs to a centralized analytics platform for correlation
Alert on invocation patterns that reference dangerous PHP functions in HTTP request bodies or query strings
Baseline normal export volume and alert on deviations by user or by time of day

How to Mitigate CVE-2026-76551

Immediate Actions Required

Update WP Import Export Lite to version 3.9.33 or later on every affected WordPress site
Audit user roles and revoke the plugin's export permission from accounts that do not require it
Rotate credentials for any account that held export permission during the exposure window
Review web-accessible directories for unauthorized PHP files and remove them

Patch Information

The vendor addressed the issue in WP Import Export Lite version 3.9.33 by restricting which PHP functions can be applied to exported field values. Administrators should apply the update through the WordPress plugin manager or by deploying the patched release from the plugin repository. Full details are available in the WPScan Vulnerability Report.

Workarounds

Deactivate WP Import Export Lite until the patched version can be installed
Restrict the plugin's export capability to administrator accounts only
Place the WordPress admin interface behind an IP allowlist or VPN to reduce the exposed attack surface
Deploy a web application firewall rule that blocks requests containing dangerous PHP function names in export parameters

bash

# Configuration example: verify installed plugin version via WP-CLI
wp plugin get wp-import-export-lite --field=version
wp plugin update wp-import-export-lite --version=3.9.33