Aller au contenu
en Se connecter
8.8 Élevée

CVE-2026-76552 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it…

Description

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.

Produits et versions touchés

Produit Versions touchées Corrigé en
WP Import Export Lite 3.9 premières → < 3.9.33 3.9.33

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de WP Import Export Lite

Les 10 CVE de WP Import Export Lite →
CVE-2026-76554 The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to… 7.2 Élevée CVE-2026-76556 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values… 6.8 Moyenne CVE-2026-76555 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it… 6.8 Moyenne CVE-2026-76559 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during… 4.1 Moyenne
Suivre cette CVE