Quick answers
- Is CVE-2026-76551 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76551 being exploited in the wild.
- How severe is CVE-2026-76551?
- High severity, with a CVSS score of 7.2, published 16 September 2026.
- Which products and versions are affected?
- WP Import Export Lite WP Import Export Lite before 3.9.33.
- Is there a fix for CVE-2026-76551?
- A patch was published on 2026-09-16: Fixed in version 3.9.33 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-76551 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-76551?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a code injection issue (CWE-94) in the export functionality of WP Import Export Lite. The plugin does not restrict or validate which PHP functions may be applied to exported field values, allowing an authenticated attacker with export permissions to invoke arbitrary PHP functions on attacker-controlled data, resulting in remote code execution. This is an authenticated vulnerability requiring a user account with export permissions to exploit. The vulnerability has been fixed in version 3.9.33.
Affected products
- WP Import Export Lite WP Import Export Lite before 3.9.33
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 3.9.33