CyberRota Analysis
AI-GeneratedThe WP Import Export Lite plugin for WordPress versions prior to 3.9.33 is vulnerable due to inadequate validation of files imported from user-supplied URLs, enabling attackers with import permissions to upload arbitrary files, including executable code. This flaw poses a significant risk of remote code execution, potentially compromising the integrity and security of the affected WordPress installations. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.