CVE-2026-104763 in Post Export Import with Media Plugin
Summary
by MITRE • 10/10/2026
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified within the Post Export Import with Media plugin for WordPress, affecting all versions up to and including 1.17.1, represents a critical security flaw classified as Directory Traversal or Path Traversal. This issue stems from insufficient sanitization of user-supplied input specifically within the file_path parameter during the media import process. The core technical failure lies in the application's handling of ZIP archive contents where an attacker can manipulate internal metadata files to inject path traversal sequences, such as ../..//etc/passwd, into the destination filename logic. Although version 1.13.2 introduced a guard mechanism designed to restrict file uploads based on allowed extensions, this mitigation is effectively bypassed by crafting a malicious ZIP archive that contains a media_metadata.json file with these traversal characters in the path field while still adhering to an allowed extension pattern for the final destination filename. This allows the server-side script to resolve the absolute or relative paths incorrectly, leading to writes outside of the intended upload directory structure.
From an operational perspective, this vulnerability enables authenticated attackers possessing administrator-level access and above to read arbitrary files from the underlying server file system. The ability to traverse directories means that sensitive configuration files, database credentials stored in wp-config.php, source code for other plugins or themes, and potentially environment variables can be exfiltrated. This level of access significantly escalates the risk profile as it provides a foothold for further exploitation, including remote code execution if combined with other vulnerabilities such as insecure file uploads that allow PHP script injection into readable files. The requirement for administrator-level privileges narrows the attack surface slightly compared to unauthenticated flaws but remains severe given that compromised admin accounts are common targets in web application attacks and often serve as a pivot point for broader network compromise.
In terms of industry standard classifications, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes how software does not properly neutralize special elements within file paths that can resolve to directories outside of the restricted directory. Furthermore, from an offensive security framework perspective, this technique is consistent with ATT&CK T1083: File and Directory Discovery, where adversaries use operating system utilities or scripts to explore a compromised environment for information relevant to their objectives. The specific method of using metadata files within archives to bypass extension guards also reflects common evasion techniques observed in advanced persistent threats seeking to maintain persistence or escalate privileges without triggering immediate security alerts associated with standard file upload vulnerabilities.
Mitigation strategies should prioritize immediate updates to the latest patched version of the Post Export Import with Media plugin, which addresses these input validation failures by properly canonicalizing and validating paths before processing them for storage operations. In environments where updating is not immediately feasible, administrators should enforce strict server-side controls such as chroot jails or containerization limits that restrict file system access regardless of application-level flaws. Additionally, implementing Web Application Firewall rules to detect common path traversal sequences in POST requests targeting media upload endpoints can provide a layer of defense-in-depth. Regular audits of plugin code for proper input sanitization and adherence to the principle of least privilege are essential to prevent similar vulnerabilities from being exploited or introduced in future updates.