The WP Import Export Lite plugin for WordPress contains a flaw in the wpie_parse_upload_data function that fails to validate the MIME type of uploaded files. The absence of this validation allows authenticated users at the Subscriber level or higher, with any privileges granted by an Administrator, to upload arbitrary files onto the site’s server. Because the plugin does not restrict the types of files that can be uploaded, an attacker could place scripts or executable code in these files, potentially leading to remote code execution on the server. The vulnerability was only partially addressed in version 3.9.29, leaving affected installations still at risk.

WordPress sites that have installed the vjinfotech WP Import Export Lite plugin version 3.9.29 or earlier. Any subscribers who have been granted permission by an Administrator can act on the vulnerability. Sites that run the plugin without updates are therefore exposed.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of <1% shows the likelihood of exploitation is currently low. However, the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access, but an attacker who can elevate a subscriber account or trick an administrator into approving the upload can exploit this flaw. Once a malicious file is uploaded, the potential for remote code execution poses a significant threat to confidentiality, integrity, and availability of the affected WordPress site.