A critical vulnerability in the WP Import Export Lite plugin allows authenticated attackers to execute arbitrary code on the server by manipulating file export paths.

This flaw involves improper validation of user-supplied output paths during the file export process (CWE-94). An attacker with administrative or specific export-level privileges can leverage this to write malicious files to arbitrary server locations.

The ability to achieve remote code execution poses a severe threat to the entire hosting environment, potentially leading to full system compromise, data exfiltration, or the deployment of ransomware. With a CVSS score of 7.2, this vulnerability represents a significant risk to organizational integrity and operational continuity, as it allows for complete control over the affected web server.

Immediate Action: Update the WP Import Export Lite plugin to version 3.9.34 or later immediately to apply the necessary path validation fixes.

Proactive Monitoring: Review web server access logs for unusual file write operations or requests targeting the export functionality, and monitor for unexpected file creation in directories outside the intended export path.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block suspicious file path traversal attempts or unauthorized code injection patterns.

Public Exploit Available: No confirmed public exploit exists in the provided data.

Given the potential for remote code execution, this vulnerability must be treated with high priority. Administrators should audit user accounts to ensure that export privileges are granted only to trusted personnel and verify that the plugin has been updated to the corrected version to eliminate the underlying path validation flaw.