Executive brief
WP Import Export Lite is a WordPress plugin used to import and export content. A flaw in the plugin before version 3.9.34 allows users with export permissions to write files to arbitrary locations on the server, enabling attackers to execute malicious code and take over the WordPress site.
Technical details
The vulnerability is a path traversal / arbitrary file write issue (CWE-94) in the export functionality. The plugin fails to validate user-supplied output paths when writing export files, allowing authenticated users with export permission to specify arbitrary file locations. An attacker can leverage this to write PHP or other executable files to the webroot, achieving remote code execution. The vulnerability requires authentication and export-level privileges. A patch was released in version 3.9.34.
Affected products
- WP Import Export Lite WP Import Export Lite before 3.9.34
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Version 3.9.34 released