WP Import Export Lite vulnerabilities
We track 4 vulnerabilities in WP Import Export Lite products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 19, 2026.
Latest WP Import Export Lite vulnerabilities
- 7.2 High severity
WP Import Export Lite: Improper Privilege Management
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 pe
- 8.8 High severity
WP Import Export Lite: Unrestricted Upload of File with Dangerous Type
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable
- 7.2 High severity
WP Import Export Lite: Improper Control of Generation of Code
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote co
- 7.2 High severity
WP Import Export Lite: Improper Control of Generation of Code
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to