CVE-2026-76554

Received Received - Intake

Privilege Escalation in WP Import Export Lite WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-76554

Affected Vendors & Products

Vendor	Product	Version / Range
wp_import_export_lite	wp_import_export_lite	to 3.9.35 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WP Import Export Lite WordPress plugin versions before 3.9.35. It allows users with delegated plugin permissions to create administrator accounts or modify existing accounts, including overwriting credentials and roles, without proper authorization checks.

Detection Guidance

Check if the WP Import Export Lite plugin version is below 3.9.35. Log in to your WordPress admin panel, go to Plugins, and verify the installed version. If it is outdated, update it immediately.

Impact Analysis

An attacker with limited access could escalate privileges to gain full administrative control over a WordPress site. This could lead to complete site takeover, data theft, or malicious content injection.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR and HIPAA compliance requirements for data protection and access controls.

Mitigation Strategies

Update the WP Import Export Lite plugin to version 3.9.35 or later. Review user accounts for unauthorized changes, especially administrator roles. Remove any unknown administrator accounts and reset credentials for existing users.

Hi! I’m here to help you understand CVE-2026-76554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70