The WP Import Export Lite plugin before version 3.9.34 fails to validate a user‑supplied output path when creating export files. This lack of validation allows a user who has the export capability to write files with arbitrary names to arbitrary locations on the server. If the attacker can place a PHP file or other executable content in a web‑accessible directory, executing that file leads to code running with the web server’s privileges. The weakness can directly compromise confidentiality, integrity, and availability of the entire site, and it is categorized under path traversal and improper file handling.

WordPress sites running the WP Import Export Lite plugin with a version older than 3.9.34 are vulnerable. Any environment where the plugin is installed and users can be granted export permissions – typically administrators, editors, or custom roles with export capability – falls into the attack surface. Known affected vendors/products are listed as Unknown:WP Import Export Lite in CNA data, indicating a lack of vendor‑wide official remediation at this time, but the plugin version itself is the key determinant.

The vulnerability is a high‑impact remote code execution flaw with an EPSS score of less than 1 % and no listing in the CISA KEV catalog. The attack requires a valid authenticated user with export rights, which are often granted to content editors or users with elevated access. Attackers must control the export path field to exploit the traversal; however, once exploited, any uploaded file can be executed. Given the severity and the fact that the fix is available in a newer plugin release, the risk is moderate to high until remediation is applied.