Improper URL Validation in WP Import Export Lite Plugin by WordPress
CVE-2026-76559
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 16 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-76559?
The WP Import Export Lite plugin for WordPress has a vulnerability due to inadequate URL validation during the import process. This oversight allows users with import privileges, typically held by administrators, to send requests to internal hosts and services, leading to potential information disclosure. This issue represents an incomplete fix for a previously identified vulnerability, making it crucial for users to update to version 3.9.33 or later to mitigate risks.
Affected Version(s)
WP Import Export Lite 0 < 3.9.33
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.