A critical code injection vulnerability in the WP Import Export Lite plugin allows authenticated users with export privileges to execute arbitrary code on the underlying server.

This is a code injection flaw (CWE-94) where the plugin fails to restrict PHP functions applied to exported field values. An attacker with specific export permissions can leverage this oversight to invoke arbitrary functions, resulting in remote code execution on the host server.

The ability to execute arbitrary code on the web server poses a severe risk to organizational data and infrastructure. If compromised, an attacker could gain full control over the WordPress environment, leading to data exfiltration, unauthorized administrative actions, or the deployment of persistent backdoors. While the CVSS score of 7.2 reflects a high severity, the impact of remote code execution warrants immediate attention to prevent total system compromise.

Immediate Action: Update the WP Import Export Lite plugin to version 3.9.33 or later immediately to apply the necessary function restrictions.

Proactive Monitoring: Review web server access logs for unusual POST requests or attempts to invoke unexpected PHP functions associated with the export module.

Compensating Controls: If immediate patching is not possible, restrict access to the export functionality to only the most trusted administrative users and deploy a Web Application Firewall (WAF) to detect and block suspicious code injection patterns.

Public Exploit Available: Unknown

Given that this vulnerability allows for remote code execution, it represents a significant security risk despite the requirement for existing permissions. Security teams should prioritize updating this plugin across all affected WordPress installations to ensure that arbitrary PHP function execution is no longer possible. Patching remains the most effective method to eliminate this risk entirely.