The WP Import Export Lite plugin before version 3.9.34 fails to validate a user‑supplied output path when creating export files. This lack of validation allows a user who has the export capability to write files with arbitrary names to arbitrary locations on the server. If the attacker can place a PHP file or other executable content in a web‑accessible directory, executing that file leads to code running with the web server’s privileges. The issue encompasses path traversal, improper file handling, and code injection (CWE‑94), directly compromising confidentiality, integrity, and availability of the entire site.

WordPress sites running the WP Import Export Lite plugin with a version older than 3.9.34 are vulnerable. Any environment where the plugin is installed and users can be granted export permissions – typically administrators, editors, or custom roles with export capability – falls into the attack surface. Known affected vendors/products are listed as Unknown:WP Import Export Lite in CNA data, indicating a lack of vendor‑wide official remediation at this time, but the plugin version itself is the key determinant.

The vulnerability carries a CVSS score of 7.2, indicating high severity, while the EPSS score is below 1 %, reflecting a low probability of exploitation but not negligible. The flaw is not listed in the CISA KEV catalog. Attackers require an authenticated user with export rights, often granted to content editors or users with elevated access. By controlling the export path field, an attacker can write arbitrary files, including PHP, to the server. The resulting code execution can occur with web server privileges, potentially giving the attacker full control over the site.