WordPress Plugin Fails to Verify User Permission Escalation

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-76554 is an authorization bypass vulnerability in the WP Import Export Lite WordPress plugin that allows users with limited import permissions to escalate their privileges by creating or modifying user accounts and assigning administrative roles. This vulnerability is critical because it breaks the principle of least privilege—a foundational security control in WordPress multisite and shared hosting environments. Any WordPress site running the vulnerable plugin (before version 3.9.35) where users have been granted import permissions is at risk, including those managed by agencies, enterprises, and hosting providers that delegate specific administrative functions to contractors or team members.

Casky's 224 mapped skills detect this attack pattern through MITRE ATT&CK technique TA0004 (Privilege Escalation), enabling practitioners to identify suspicious behavior across multiple detection layers. When monitoring for this CVE, security teams would see skill findings highlighting improper access control validation, unauthorized role assignments tied to import functions, and account modification events by users lacking the necessary permissions. Claude's extended reasoning would correlate these signals—such as import plugin activity preceding unexpected administrator account creation or credential changes—to surface the permission-checking gap that makes this vulnerability exploitable, helping practitioners distinguish between legitimate administrative actions and privilege escalation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-76554.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-76554

Casky has 224 skills that investigate the attack patterns behind CVE-2026-76554. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn