CVE-2026-76556EPSS p30.9%

CVE-2026-76556CVE-2026-76556

Description

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.

Scoring

CVSS 6.8 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
EPSS0.39% probability of exploitation · percentile 30.9% · 2026-10-05T12:00:23Z
Last modified2026-09-17
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.