A critical file upload vulnerability in the WP Import Export Lite WordPress plugin allows authenticated users to achieve remote code execution.

This flaw stems from improper input validation (CWE-434) during the import process, where the plugin fails to verify the content or extension of files retrieved from user-supplied URLs. Any user granted import privileges can exploit this to upload malicious scripts and achieve remote code execution.

Successful exploitation permits an attacker to execute arbitrary code with the privileges of the web server, leading to a complete system compromise. Given the CVSS score of 8.8, this vulnerability poses a severe risk to data integrity, confidentiality, and availability, potentially resulting in unauthorized data exfiltration or total service disruption.

Immediate Action: Update the WP Import Export Lite plugin to version 3.9.33 or later immediately to apply the necessary file validation controls.

Proactive Monitoring: Review web server access logs for requests targeting import functionality and monitor for the creation of unexpected files in the plugin upload directories.

Compensating Controls: Utilize a Web Application Firewall to block suspicious file upload attempts and restrict access to the import functionality to only trusted, highly privileged administrative accounts.

Public Exploit Available: No confirmed public exploit is available.

The vulnerability represents a significant security risk that could lead to a total compromise of the host environment. Administrators must prioritize updating the WP Import Export Lite plugin to version 3.9.33 to eliminate the underlying attack vector. In environments where immediate patching is not feasible, restrict plugin access and heighten monitoring until the update is applied.