The vulnerability exists in the file upload handling of the plugin, specifically the 'wpie_tempalte_import' function. By omitting file type validation, an attacker who is logged in at the Subscriber level or higher can upload any file to the server. If the uploaded file is crafted to be executable—such as a PHP script—it can lead to remote code execution, granting the attacker full control over the site. The weakness involves improper restriction of file uploads, identified as CWE-434.

Any WordPress site running the WP Import Export Lite plugin version 3.9.28 or earlier is impacted. The plugin is distributed by vjinfotech and integrates into WordPress installations via the WordPress plugin framework. Only sites where users have Subscriber-level access or higher, and where administrators have granted upload permissions, are at risk.

The CVSS score of 7.5 places this flaw in the high severity range, indicating significant potential damage. The EPSS score of less than 1% suggests a low but not negligible probability of exploitation at the time of assessment. The vulnerability is not currently listed in the CISA KEV catalog, which may reduce urgency but does not eliminate the risk. Attackers need legitimate authenticated credentials with sufficient access, but once those exist, the upload path can be used to place malicious files that may be executed if the server's file permissions or PHP settings allow it.