Executive brief
WP Import Export Lite is a WordPress plugin that allows administrators to grant users permission to import data into their WordPress sites. The plugin fails to properly sanitize user-supplied import configuration values before using them in SQL queries, allowing authorized users to inject malicious SQL code and potentially access or modify sensitive database records.
Technical details
The vulnerability is a SQL injection (SQLi) flaw in the import options handling of WP Import Export Lite. The plugin does not properly sanitize or escape import configuration parameters before incorporating them into SQL statements. The attack requires that an administrator has explicitly granted the attacker the plugin's import permission, limiting the threat to users with delegated administrative capabilities. An authenticated attacker with import permissions can craft malicious SQL in the import configuration to execute arbitrary database queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability was patched in version 3.9.33.
Affected products
- WP Import Export Lite WP Import Export Lite before 3.9.33
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 3.9.33