CVE-2026-76552: WP Import Export Lite RCE Vulnerability

CVE-2026-76552 Overview

CVE-2026-76552 affects the WP Import Export Lite WordPress plugin in versions prior to 3.9.33. The plugin retrieves files from user-supplied URLs during import operations without validating file type, extension, or content. Any user granted import permission can upload arbitrary files, including executable PHP files, and achieve remote code execution on the server. The flaw maps to CWE-434 Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated users with import privileges can execute arbitrary code on the WordPress host, leading to full site compromise and lateral movement into the underlying server environment.

Affected Products

WP Import Export Lite WordPress plugin versions before 3.9.33
WordPress sites where the plugin is active and import permissions are delegated to non-administrator roles
Shared hosting environments running vulnerable plugin installations

Discovery Timeline

2026-09-16 - CVE-2026-76552 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76552

Vulnerability Analysis

The WP Import Export Lite plugin exposes an import feature that fetches remote resources from a URL supplied by the requesting user. The import handler writes the retrieved payload to the WordPress uploads directory without inspecting the MIME type, file extension, or file contents. An attacker with the plugin's import capability can point the importer at a URL serving a PHP web shell. Once the file lands inside the web root, requesting it triggers server-side execution under the web server user.

This is an authenticated remote code execution issue. The attack vector is network-based and the required privilege level is any account holding the plugin's import permission, which is often delegated to editor-tier roles rather than reserved for administrators.

Root Cause

The root cause is missing input validation on the file retrieval routine used during imports. The plugin trusts the response from the user-supplied URL and stores the payload verbatim. No allowlist restricts extensions to expected import formats such as .csv, .xml, or .json, and no content inspection prevents PHP source from being written into a web-accessible directory.

Attack Vector

An authenticated user submits an import request referencing an attacker-controlled URL that serves a PHP payload. The plugin downloads the payload, stores it under the WordPress uploads path, and returns the storage location. The attacker then issues an HTTP request to the stored file, causing PHP-FPM or the Apache PHP module to execute the payload. Successful exploitation yields command execution, database access, and pivot capability inside the hosting environment.

No public proof-of-concept exploit is currently listed for this CVE. Refer to the WPScan Vulnerability Report for technical details maintained by the disclosing researchers.

Detection Methods for CVE-2026-76552

Indicators of Compromise

Unexpected .php, .phtml, or .phar files present under the WordPress wp-content/uploads/ directory tree
Import job logs referencing external URLs that do not match legitimate data sources
Outbound HTTP requests from the WordPress host to unfamiliar domains initiated during import operations
Web server access logs showing GET requests to newly created files under uploads/ followed by anomalous process activity

Detection Strategies

Monitor file creation events under WordPress upload directories and alert on executable extensions
Correlate WordPress audit logs of import actions with subsequent file writes and outbound network calls
Baseline the child processes of php-fpm and web server workers, and flag deviations such as shell spawning

Monitoring Recommendations

Enable WordPress activity logging that captures the user, timestamp, and URL parameter for every import request
Forward web server, PHP error, and file integrity logs to a centralized analytics platform for correlation
Alert on modifications to plugin directories and any write of scripts into publicly served paths

How to Mitigate CVE-2026-76552

Immediate Actions Required

Upgrade WP Import Export Lite to version 3.9.33 or later on every WordPress installation
Audit user roles and revoke the plugin's import capability from any account that does not require it
Inspect the wp-content/uploads/ tree for unexpected executable files and quarantine any suspicious artifacts
Rotate WordPress administrator credentials and database passwords if compromise is suspected

Patch Information

The vendor addressed the vulnerability in WP Import Export Lite version 3.9.33 by validating the type, extension, and content of files retrieved from user-supplied URLs. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. Additional advisory information is available in the WPScan Vulnerability Report.

Workarounds

Deactivate the WP Import Export Lite plugin until the patched version can be installed
Configure the web server to deny execution of PHP files inside wp-content/uploads/ using directory-level handlers
Restrict outbound HTTP requests from the WordPress host to a defined allowlist of trusted import sources

bash

# Apache: block PHP execution within the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9]+)$ {
    deny all;
    return 403;
}