CyberRota Analysis
AI-GeneratedThe WP Import Export Lite plugin for WordPress versions prior to 3.9.33 is vulnerable due to insufficient restrictions on PHP functions applied to exported field values. This flaw allows users with export permissions to invoke arbitrary PHP functions on controlled values, potentially leading to remote code execution. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this critical security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.