WordPress Export Plugin Arbitrary Function Execution Flaw

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-76551 affects the WP Import Export Lite WordPress plugin versions before 3.9.33, exposing a critical input validation gap in its export functionality. The vulnerability allows users with export permissions to invoke arbitrary PHP functions on controlled field values, bypassing intended restrictions and enabling remote code execution (RCE). This is particularly dangerous because export features are commonly granted to trusted roles like editors or administrators, meaning compromised accounts or insider threats can escalate privileges and take complete control of affected WordPress installations. Organizations relying on this plugin for data management—especially those handling sensitive customer or business data—face significant risk of data theft, site defacement, or use of their infrastructure for further attacks.

Casky's 323 mapped skills detect this vulnerability pattern across two critical MITRE ATT&CK phases: Initial Access (TA0001) and Resource Development (TA0043). Claude's extended reasoning identifies the telltale signs practitioners should monitor: unexpected function calls within export operations, suspicious parameter manipulation in database queries, and privilege escalation attempts originating from export-authorized user accounts. By mapping to CWE-94 (Improper Control of Generation of Code), Casky's skills help security teams spot queries or logs showing function names being dynamically executed—such as `system()`, `exec()`, or `eval()`—on user-supplied data. Practitioners querying their findings would see anomalous export requests containing PHP function names as values, followed by command execution in system logs or web server access patterns indicating post-exploitation activity.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-76551.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-76551

Casky has 323 skills that investigate the attack patterns behind CVE-2026-76551. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn