CVE-2026-76559CWE-918ssrf

CVE-2026-76559

Medium · published September 16, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-16T10:16Z
References (1)
https://wpscan.com/vulnerability/62e27c51-95c7-407b-81aa-85757130adb9/ · [email protected]
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 16 SEP 06:00Z
    WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling
    cvelistv5