# CVE-2026-76550: WP Import Export Lite path traversal remote code execution

Source: https://junglewise.ai/threats/cve-2026-76550-wp-import-export-lite-path-traversal-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76550 · Severity: high · CVSS 7.2 · Published 2026-09-16

WP Import Export Lite is a WordPress plugin used to import and export content. A flaw in the plugin before version 3.9.34 allows users with export permissions to write files to arbitrary locations on the server, enabling attackers to execute malicious code and take over the WordPress site.

## Quick answers

**Is CVE-2026-76550 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76550 being exploited in the wild.

**How severe is CVE-2026-76550?** High severity, with a CVSS score of 7.2, published 16 September 2026.

**Which products and versions are affected?** WP Import Export Lite WP Import Export Lite before 3.9.34.

**Is there a fix for CVE-2026-76550?** A patch was published on 2026-09-14: Version 3.9.34 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76550 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76550?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal / arbitrary file write issue (CWE-94) in the export functionality. The plugin fails to validate user-supplied output paths when writing export files, allowing authenticated users with export permission to specify arbitrary file locations. An attacker can leverage this to write PHP or other executable files to the webroot, achieving remote code execution. The vulnerability requires authentication and export-level privileges. A patch was released in version 3.9.34.

## Affected products

- WP Import Export Lite WP Import Export Lite before 3.9.34

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Version 3.9.34 released

## References

- [https://wpscan.com/vulnerability/d739fefd-cc21-49ce-90a1-b16c159e9389/](https://wpscan.com/vulnerability/d739fefd-cc21-49ce-90a1-b16c159e9389/)