CVE-2026-76554: CWE-269 Improper Privilege Management in WP Import Export Lite
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
AI Analysis
Technical Summary
CVE-2026-76554 is an improper privilege management vulnerability (CWE-269) in the WP Import Export Lite WordPress plugin prior to version 3.9.35. The plugin fails to verify whether the user running an import operation has permission to create or modify user accounts and assign roles. As a result, users granted delegated permissions for the plugin, who otherwise lack user management rights, can escalate privileges by creating new administrator accounts or modifying existing ones, including overwriting administrator credentials and roles.
Potential Impact
This vulnerability allows unauthorized privilege escalation within WordPress sites using affected versions of the WP Import Export Lite plugin. Attackers with delegated plugin permissions can gain full administrative control by creating or modifying administrator accounts, potentially compromising the entire site.
Mitigation Recommendations
Upgrade the WP Import Export Lite plugin to version 3.9.35 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the version boundary provided.
CVE-2026-76554: CWE-269 Improper Privilege Management in WP Import Export Lite
Description
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
CVSS v3.1
Score 7.2high
Affected software
WP Import Export Lite
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76554 is an improper privilege management vulnerability (CWE-269) in the WP Import Export Lite WordPress plugin prior to version 3.9.35. The plugin fails to verify whether the user running an import operation has permission to create or modify user accounts and assign roles. As a result, users granted delegated permissions for the plugin, who otherwise lack user management rights, can escalate privileges by creating new administrator accounts or modifying existing ones, including overwriting administrator credentials and roles.
Potential Impact
This vulnerability allows unauthorized privilege escalation within WordPress sites using affected versions of the WP Import Export Lite plugin. Attackers with delegated plugin permissions can gain full administrative control by creating or modifying administrator accounts, potentially compromising the entire site.
Mitigation Recommendations
Upgrade the WP Import Export Lite plugin to version 3.9.35 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the version boundary provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-19T12:52:37.640Z
- State
- PUBLISHED
Threat ID: 6aae2c6755bf5e2cf5363ad2
Added to database: 09/19/2026, 06:32:07 UTC
Last enriched: 09/19/2026, 06:47:29 UTC
Last updated: 09/20/2026, 02:27:52 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.