The WP Import Export Lite WordPress plugin, versions below 3.9.33, fails to restrict which PHP function may be applied to exported field values. Users with export permission can supply values that are interpreted as PHP functions, allowing arbitrary code execution on the server. This vulnerability is essentially a code injection flaw that lets an attacker run any PHP function they choose, compromising the confidentiality, integrity, and availability of the affected WordPress installation.

All WordPress sites that have the WP Import Export Lite plugin installed and are using a version earlier than 3.9.33 are affected. The plugin itself is the only impacted component; no other WordPress core or third‑party components are mentioned.

The EPSS score of less than 1% indicates that the likelihood of exploitation is low based on current data, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread, confirmed exploitation. The attack vector requires authentication with export permission, meaning that user privileges must narrow down to those who can export data. Once authenticated, an attacker can craft a malicious field value that triggers a PHP function, leading to remote code execution. The severity of the flaw remains high due to the full RCE capability, but the overall risk is moderated by the low probability of activation.