Executive brief
WP Import Export Lite is a WordPress plugin used to import and export data. The plugin fails to validate file paths before deleting directories, allowing delegated users to delete arbitrary folders and files anywhere on the server, including critical system directories outside the web root, potentially leading to data loss or service disruption.
Technical details
The vulnerability is a path traversal leading to arbitrary directory deletion (CWE-73). The plugin takes a path from stored user-supplied data (the "template path") without proper validation before recursively deleting the directory it resolves to. Attack requires a user with delegated WP Import Export Lite plugin capabilities—typically an editor or administrator role. An authenticated attacker can craft a malicious path to delete arbitrary directories and all files within them, including locations outside the web root. The vulnerability is fixed in version 3.9.33.
Affected products
- WP Import Export Lite WP Import Export Lite before 3.9.33
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 3.9.33