CVE-2026-76554

Name of the Vulnerable Software and Affected Versions WP Import Export Lite WordPress plugin versions prior to 3.9.35

Description The plugin fails to verify if the user performing an import has the necessary permissions to create or modify user accounts and assign roles. This allows users with delegated permissions for the plugin, who lack general user management privileges, to create new administrator accounts or overwrite the credentials and roles of existing accounts, including those of administrators.

Recommendations Update WP Import Export Lite WordPress plugin to version 3.9.35 or later.