The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wp Import Export Lite Plugin | — | Update wp-import-export-lite plugin to version 3.9.16, or a newer patched version | May 15, 2025 | Jan 14, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub