6.5
Moyenne
CVE-2026-76553 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied…
Description
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP Import Export Lite 3.9 | premières → < 3.9.33 | 3.9.33 |
Autres CVE de WP Import Export Lite
Les 10 CVE de WP Import Export Lite →
CVE-2026-76554
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to…
7.2
Élevée
CVE-2026-76556
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values…
6.8
Moyenne
CVE-2026-76555
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it…
6.8
Moyenne
CVE-2026-76559
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during…
4.1
Moyenne