CVE-2026-76553: WP Import Export Lite Path Traversal Flaw

CVE-2026-76553 Overview

CVE-2026-76553 affects the WP Import Export Lite WordPress plugin in versions prior to 3.9.33. The plugin fails to validate a filesystem path taken from stored, user-supplied data before recursively deleting the target directory. An authenticated user with a delegated plugin capability can delete arbitrary directories and every file within them, including locations outside the web root. The weakness is categorized as CWE-73: External Control of File Name or Path.

Critical Impact
Attackers holding delegated plugin capabilities can recursively delete arbitrary directories on the host, destroying WordPress files, backups, or other application data outside the web root.

Affected Products

WP Import Export Lite WordPress plugin versions prior to 3.9.33

Discovery Timeline

2026-09-16 - CVE-2026-76553 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76553

Vulnerability Analysis

The vulnerability resides in a plugin routine that reads a directory path from previously stored, user-supplied data and passes it into a recursive delete operation. The plugin performs the deletion without validating that the resolved path stays within an intended directory boundary.

An administrator can delegate a plugin capability to lower-privileged roles. Any user holding that delegated capability can trigger the vulnerable code path. Because the deletion is recursive, an entire directory tree is removed once the path resolves.

Successful exploitation impacts integrity and availability. Attackers can destroy WordPress core files, plugin data, uploads, or unrelated files on the same filesystem accessible to the web server process.

Root Cause

The plugin trusts stored path data without canonicalization or allowlist checks. The recursive delete function follows whatever path the attacker previously injected into storage, enabling traversal outside the plugin's expected working directory.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account with the delegated WP Import Export Lite capability. The attacker seeds a malicious path into the plugin's stored configuration, then triggers the workflow that invokes the recursive directory deletion. The web server user's filesystem permissions define the outer bound of destructive reach.

No verified proof-of-concept code is publicly available. Technical details are described in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-76553

Indicators of Compromise

Unexpected disappearance of directories under wp-content/, wp-includes/, or paths outside the web root owned by the web server user.
WordPress error logs referencing rmdir, unlink, or recursive deletion functions invoked from the WP Import Export Lite plugin.
Audit log entries showing non-administrator users invoking WP Import Export Lite import, export, or cleanup actions.

Detection Strategies

Compare filesystem inventories against known-good baselines to identify missing directories on hosts running vulnerable plugin versions.
Enable WordPress audit logging and alert on capability delegations that grant plugin actions to non-administrator roles.
Review web server access logs for POST requests to WP Import Export Lite endpoints originating from lower-privileged accounts.

Monitoring Recommendations

Monitor PHP process file operations targeting paths outside wp-content/uploads/ associated with the plugin.
Alert on WordPress plugin version inventory changes and flag hosts still running versions below 3.9.33.
Track failed and successful authentication for accounts assigned WP Import Export Lite capabilities.

How to Mitigate CVE-2026-76553

Immediate Actions Required

Update WP Import Export Lite to version 3.9.33 or later on all WordPress installations.
Audit user roles and revoke any WP Import Export Lite capability delegated to non-administrator accounts until patching is complete.
Verify recent backups of WordPress files, uploads, and databases are intact and restorable.

Patch Information

The vendor addressed the issue in WP Import Export Lite version 3.9.33. The fix validates path input from stored data before recursive deletion. See the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict the WP Import Export Lite capability to trusted administrator accounts only.
Run PHP-FPM or the web server under a least-privilege user that cannot access paths outside the WordPress document root.
Deploy filesystem-level immutability or snapshot protection on directories outside wp-content/ to limit destructive scope.

bash

# Configuration example: restrict filesystem access via systemd unit for php-fpm
# /etc/systemd/system/php-fpm.service.d/hardening.conf
[Service]
ReadWritePaths=/var/www/html/wp-content
ProtectSystem=strict
ProtectHome=true