CVE-2026-76553

MediumCVSS 6.5/10Last modified Sep 17, 2026

Description

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-765547.2The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify us CVE-2026-765556.8The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a CVE-2026-765566.8The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them i CVE-2026-765576.8The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using CVE-2026-765586.8The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting the CVE-2026-765594.1The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, a CVE-2026-76566.8The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boole CVE-2026-765607.5A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN ag CVE-2026-765617.2A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not CVE-2026-765627.2The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbm_description' parameter in all versi CVE-2026-765648.6Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7 CVE-2026-765655.3Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7