CyberRota Analysis
AI-GeneratedThe WP Import Export Lite plugin for WordPress versions prior to 3.9.34 is vulnerable due to inadequate validation of user-supplied output paths, enabling users with export permissions to write files with arbitrary names to any location on the server. This flaw can lead to remote code execution, posing a significant risk to the integrity and security of the affected WordPress installations. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.