CVE-2026-76559EPSS p20.5%

CVE-2026-76559CVE-2026-76559

Description

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.

Scoring

CVSS 4.1 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
EPSS0.30% probability of exploitation · percentile 20.5% · 2026-10-05T12:00:23Z
Last modified2026-09-17
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.