wpazleen Post Export Import with Media Plugin up to 1.13.1 File Upload/Validation shell.php ajax_import_media_start unrestricted upload

Summaryinfo

A vulnerability labeled as problematic has been found in wpazleen Post Export Import with Media Plugin up to 1.13.1. This vulnerability affects the function ajax_import_media_start of the file shell.php of the component File Upload/Validation. Executing a manipulation can lead to unrestricted upload. This vulnerability is registered as CVE-2026-13430. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in wpazleen Post Export Import with Media Plugin up to 1.13.1. This vulnerability affects the function ajax_import_media_start of the file shell.php of the component File Upload/Validation. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.13.1 via the import_media_file_secure function. This is due to insufficient file extension validation caused by a trailing-dot filename bypass, where the extension allow-list check in ajax_import_media_start() uses pathinfo() on the raw ZIP entry name (e.g., 'shell.php.'), which returns an empty string for the extension, causing the allow-list guard to be skipped and the file to be extracted to a temporary location, after which import_media_file_secure() copies it into the WordPress uploads directory without re-validating the extension. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.

The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-13430 since 06/26/2026. The exploitation appears to be easy. The attack can be initiated remotely. The exploitation requires an enhanced level of successful authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/10/2026). The MITRE ATT&CK project declares the attack technique as T1608.002.

By approaching the search of inurl:shell.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• wpazleen

Name

• Post Export Import with Media Plugin

Version

• 1.13.0
• 1.13.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion