WP Import Export Lite

WP Import Export Lite has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 4 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 2 of the records (33%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data.

Every one of the 6 issues recorded for WP Import Export Lite has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by Vincent Fourcade (vinceMatsui). WP Import Export Lite is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Import Export Lite vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2025-5061

WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

6 records


2026-07-02 16:07	WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter WP Import Export Lite <= 3.9.30	`CVE-2026-11397`	5.5 Medium	밥김국	Yes
2025-08-04 18:52	WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload WP Import Export Lite <= 3.9.29	`CVE-2025-5061`	7.5 High	Vincent Fourcade (vinceMatsui)	Yes
2025-08-04 18:51	WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload WP Import Export Lite <= 3.9.28	`CVE-2025-6207`	7.5 High	Vincent Fourcade (vinceMatsui)	Yes
2025-04-21 00:00	WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting WP Import Export Lite <= 3.9.27	`CVE-2025-2839`	6.4 Medium	Webbernaut	Yes
2024-04-05 00:00	WP Import Export Lite <= 3.9.26 - Authenticated (Administrator+) PHP Object Injection WP Import Export Lite <= 3.9.26	`CVE-2024-31308`	7.2 High	Trình Vũ	Yes
2022-01-14 00:00	WP Import Export Lite & WP Import Export <= 3.9.15 - Unauthenticated Sensitive Data Disclosure WP Import Export Lite <= 3.9.15	`CVE-2022-0236`	7.5 High	Karan Saini	Yes

Showing 1–6 of 6 reports

Latestv3.9.35

WP Import Export Lite

Author

vjinfotech

4.0(113)

80/100

Last Updated

2026-09-12 (15h ago)

Active Installs

40,000+

Downloads

987,073

Requires WP

4.4+

Requires PHP

5.6+

Tested up to

WP 7.1

Created

2019-07-27 (7y ago)

WordPress Import Export Plugin is an easy, fast, and advanced tool to import and export your WordPress site data. WP Import Export gives you the ability to export your site data into multiple file formats and import those files into any WordPress site. All types of Posts, Pages, Custom Post Types, Taxonomies, Comments, and Users can be imported or exported with just a few clicks. It is an effective way to manage and migrate data across multiple WordPress installations. Main Features Pause, resume, and stop active imports and exports Background processing for large imports and exports Scheduled import & export (Available in Pro) Powerful data filtering options Drag-and-drop field mapping Add-on integrations for popular WordPress plugins Support for multiple file formats Detailed import process logs Pause, Resume & Stop Imports and exports can be paused, resumed, and stopped at any stage. Supports pause and resume functionality with background processing. Cancel or stop any processing task whenever needed. Background Import & Export Run import and export tasks asynchronously in the background. Background jobs can be monitored, paused, resumed, and stopped. Process multiple import and export tasks concurrently. Convert standard import/export jobs into background processes with ease. Powerful Filters Apply precise filter rules during export (e.g., export posts where Post ID is greater than 50). Advanced filtering rules for uploaded source data during import. Field Management Rearrange and edit fields quickly before exporting. Intuitive drag-and-drop field mapping for incoming import data. Multiple File Formats Full support for both import and export across multiple formats. Supports ZIP archives. Supports CSV, XLS, XLSX, JSON, TXT, ODS, and XML file formats. Scheduled Import & Export (Pro) Set up automatic cron-scheduled imports and exports. Centralized schedule management interface. Runs reliably alongside background processing. Import Process Log Comprehensive process and execution logs. Step-by-step logging for each individual record. Supported Add-Ons Yoast SEO Import & Export ACF & ACF Pro Import & Export WPML Import & Export Polylang Import & Export WooCommerce Import & Export (Pro) Schedule Import & Export (Pro) Attributes Import & Export Google Drive Import (Pro) Microsoft OneDrive Import (Pro) Dropbox Import (Pro) FTP / SFTP Import (Pro) Background Import & Export WP Import Export Professional Edition Export Premium Add-Ons ACF / ACF Pro Export Scheduled Export WooCommerce Export WPML Export Attributes Export Polylang Export Import Premium Add-Ons ACF / ACF Pro Import Dropbox File Import Upload From FTP/SFTP Google Drive File Import Microsoft OneDrive Import Scheduled Import WooCommerce Import WPML Import Attributes Import Polylang Import Upgrade to the Pro edition of WP Import Export Live Demo Try the WP Import Export Live Demo Documentation Documentation and Video Tutorials

View on WordPress.org