Directory Deletion Vulnerability in WP Import Export Lite Plugin by WordPress
CVE-2026-76553
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 16 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-76553?
The WP Import Export Lite plugin, prior to version 3.9.33, contains a flaw that permits users with certain delegated capabilities to exploit the plugin's functionality. The vulnerability arises due to the lack of validation for user-supplied data, allowing an attacker to manipulate path information. This permits the recursive deletion of arbitrary directories, potentially removing files located outside of the intended web root, leading to a significant risk of data loss.
Affected Version(s)
WP Import Export Lite 0 < 3.9.33
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.