CVE-2026-76550

HighCVSS 7.2/10Last modified Sep 17, 2026

Description

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Sep 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-765517.2The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowCVE-2026-765528.8The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-CVE-2026-765536.5The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively dCVE-2026-765547.2The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify usCVE-2026-765556.8The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into aCVE-2026-765566.8The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them iCVE-2026-765576.8The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before usingCVE-2026-765586.8The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting theCVE-2026-765594.1The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, aCVE-2026-76566.8The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect booleCVE-2026-765607.5A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN agCVE-2026-765617.2A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not
CVE-2026-76550: High severity, CVSS 7.2 | Vulnix