Path Traversal in WP Import Export Lite WordPress Plugin

Executive Summary

This vulnerability in the WP Import Export Lite WordPress plugin before version 3.9.33 allows authenticated users with delegated capabilities to delete arbitrary directories and files via a path traversal flaw. The plugin does not validate user-supplied paths before recursively deleting directories, which can lead to unauthorized file deletion outside the web root.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the WP Import Export Lite plugin. If it is below 3.9.33, the system is vulnerable. Look for unauthorized directory deletions or file loss in system logs.

Useful 0 Not Useful 0

Impact Analysis

If you are an administrator who has delegated capabilities to untrusted users, this vulnerability could allow those users to delete critical files or directories on your system. This may result in data loss, system downtime, or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized data deletion or access. GDPR requires data integrity and availability, while HIPAA mandates protection of health information. Unauthorized deletions may violate these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Import Export Lite plugin to version 3.9.33 or later immediately. Remove delegated capabilities for users who do not require plugin management to reduce attack surface.

Useful 0 Not Useful 0