Path traversal in Post Export Import with Media allows file reads
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The Post Export Import with Media plugin for WordPress is affected in all versions up to and including 1.17.1. A path traversal flaw (CWE-22) in the file_path field of media_metadata.json lets a crafted ZIP archive reference paths outside the intended directory. An authenticated attacker with administrator access or higher can read arbitrary files on the server, which may contain sensitive information.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Post Export Import with Media.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-10 Threatist record created from CVE-2026-104763
- 2026-10-10 Alias added: GHSA-vxwp-9pcg-465r
- 2026-10-11 CISA SSVC decision points changed
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/71a6ba3d-0473-46c9-8040-b415807f4073?source=cve
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L575
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L573
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L982
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L500
- https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/
- https://plugins.trac.wordpress.org/changeset/3726363/post-export-import-with-media/trunk/includes/class-media-handler.php
More wpazleen vulnerabilities
- TI-2026-83523 Arbitrary file upload in SimpleForm WordPress plugin CVSS 3.1CRITICAL 9.8
- TI-2026-73817 SimpleForm Unauthenticated Privilege Escalation via wp_capabilities CVSS 3.1CRITICAL 9.8
- TI-2026-11366 Unrestricted file upload in wpazleen Post Export Import with Media CVSS 3.1HIGH 7.2
- TI-2026-73821 Post Export Import with Media: Authenticated PHP Object Injection CVSS 3.1HIGH 7.2
- TI-2026-76039 Path traversal in Post Export Import with Media WordPress plugin CVSS 3.1MEDIUM 4.9
Sources
- CVE-2026-104763 · CVE Program
- CVE-2026-104763 · NVD
- FIRST EPSS
- GHSA-vxwp-9pcg-465r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences