CVE-2026-76555: WP Import Export Lite Path Traversal Flaw

CVE-2026-76555 Overview

CVE-2026-76555 affects the WP Import Export Lite WordPress plugin in versions prior to 3.9.33. The plugin fails to validate user-supplied file paths before reading them and copying them into a publicly accessible directory. Any user granted the plugin's import permission by an administrator can disclose sensitive files from the server, including files located outside the web root. The same code path relaxes file-system permissions of any path it processes, regardless of whether the copy operation succeeds. The vulnerability is classified as a path traversal issue [CWE-22].

Critical Impact
Authenticated users with import permissions can read arbitrary files from the server file system and weaken permissions on those files, exposing configuration data, credentials, and other sensitive assets.

Affected Products

WP Import Export Lite WordPress plugin versions prior to 3.9.33
WordPress sites where administrators have delegated import capability to non-admin roles
Any hosting environment where the plugin runs with standard web server permissions

Discovery Timeline

2026-09-16 - CVE-2026-76555 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76555

Vulnerability Analysis

The vulnerability resides in the plugin's import handler, which accepts a file path parameter from authenticated users holding the import permission. The handler reads the referenced file and copies it into a directory that is directly reachable over HTTP. Because the plugin performs no canonicalization or allowlist validation on the supplied path, attackers can specify traversal sequences or absolute paths pointing outside the intended upload directory.

A secondary issue amplifies the risk. The same code path modifies file-system permissions on any path it is handed. This permission change occurs even when the copy operation itself fails. Attackers can therefore relax access controls on arbitrary files on disk without needing a successful read.

Exploitation requires an authenticated account. However, the required import permission is a plugin-level capability that administrators frequently delegate to editor or contributor roles for content management workflows.

Root Cause

The root cause is missing input validation on a file path parameter, mapped to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The plugin trusts the caller to supply a path within the expected import staging area and never resolves the path to verify it stays within that boundary.

Attack Vector

An authenticated user with the plugin's import permission submits a crafted import request specifying a path such as ../../../../etc/passwd or an absolute path to a WordPress configuration file like wp-config.php. The plugin copies the file into a public directory, where the attacker retrieves it over HTTP. Alternatively, the attacker supplies the path of a sensitive file to trigger the permission-relaxation side effect without requiring the copy to complete.

Refer to the WPScan Vulnerability Details for additional technical context.

Detection Methods for CVE-2026-76555

Indicators of Compromise

Unexpected files appearing in the plugin's public import or upload directory, particularly files whose names or contents resemble system configuration data.
Web server access log entries showing requests to plugin import endpoints followed by direct GET requests to unusual files under wp-content/.
File-system audit events showing permission changes on files such as wp-config.php, .env, or /etc/ paths that correlate with plugin activity.

Detection Strategies

Monitor HTTP POST requests to the WP Import Export Lite import endpoints for parameters containing traversal sequences (../) or absolute paths.
Correlate plugin activity with subsequent downloads of newly created files in publicly accessible plugin directories.
Audit WordPress role assignments to identify non-administrator accounts that have been granted the plugin's import capability.

Monitoring Recommendations

Enable WordPress activity logging to capture import operations and the accounts performing them.
Alert on permission changes to sensitive files such as wp-config.php, .htaccess, and private key material.
Review web server logs for anomalous read patterns against plugin-managed directories.

How to Mitigate CVE-2026-76555

Immediate Actions Required

Update the WP Import Export Lite plugin to version 3.9.33 or later on all WordPress installations.
Audit which non-administrator roles have been granted the plugin's import permission and revoke it where not required.
Inspect the plugin's public import directory for unexpected files and remove any that expose sensitive data.
Rotate credentials stored in wp-config.php and any other files that may have been disclosed or had their permissions altered.

Patch Information

The plugin vendor has released version 3.9.33, which addresses the path traversal issue. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin files with the fixed release. See the WPScan Vulnerability Details for advisory information.

Workarounds

If immediate patching is not possible, deactivate the WP Import Export Lite plugin until the update can be applied.
Restrict the plugin's import capability to trusted administrator accounts only.
Deploy a web application firewall rule to block requests to plugin import endpoints containing path traversal patterns.

bash

# Verify installed plugin version and update via WP-CLI
wp plugin get wp-import-export-lite --field=version
wp plugin update wp-import-export-lite --version=3.9.33

# Audit users holding the plugin import capability
wp user list --role=editor --fields=ID,user_login,roles