Executive brief
WP Import Export Lite is a WordPress plugin that allows users to import and export website data. The plugin fails to validate which PHP functions can be applied to exported field values, allowing users with export permissions to execute arbitrary code on the server.
Technical details
The vulnerability is a code injection issue (CWE-94) in the export functionality of WP Import Export Lite. The plugin does not restrict or validate which PHP functions may be applied to exported field values, allowing an authenticated attacker with export permissions to invoke arbitrary PHP functions on attacker-controlled data, resulting in remote code execution. This is an authenticated vulnerability requiring a user account with export permissions to exploit. The vulnerability has been fixed in version 3.9.33.
Affected products
- WP Import Export Lite WP Import Export Lite before 3.9.33
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 3.9.33