What the vulnerability does
01Description
The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
Explanation of Vulnerability in Simple Terms
02Summary
WP Import Export Lite versions up to 3.9.29 allow authenticated users to upload files without proper validation. An attacker with low-level site access can upload malicious files, potentially gaining control of the site. The vulnerability requires network access and some attack complexity, but no user interaction beyond the initial upload.
What an attacker can do
03Attacker Capabilities
Upload malicious files to the site and execute code with site privileges.
Potential impact on your site
04Site Impact
A compromised user account or plugin misconfiguration could allow file upload leading to full site takeover.
Conditions required to exploit
05Prerequisites
Attacker needs a low-privilege account (subscriber or contributor level) on the WordPress site.
Key dates
06Disclosure timeline
August 5, 2025
CVE published
April 8, 2026
Record updated
