What is GHSA-v7v7-79q5-j8cf?

GHSA-v7v7-79q5-j8cf is a security advisory published by GitHub Security Advisories with High severity. The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may...

Which CVE IDs does GHSA-v7v7-79q5-j8cf cover?

GHSA-v7v7-79q5-j8cf covers the following CVE IDs: CVE-2026-76551. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v7v7-79q5-j8cf?

GHSA-v7v7-79q5-j8cf has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-v7v7-79q5-j8cfHighCVSS 7.2

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-76551 →

📋 Description

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-76551
https://wpscan.com/vulnerability/1ad0c536-cebd-40d2-b6a9-48c5c76e972c
https://github.com/advisories/GHSA-v7v7-79q5-j8cf