Directory Traversal Vulnerability in Post Export Import with Media Plugin for WordPress

CVE-2026-104763

What is CVE-2026-104763?

The Post Export Import with Media plugin for WordPress is susceptible to a Directory Traversal vulnerability that exists in all versions up to 1.17.1. This flaw can be exploited by authenticated users with administrator privileges who can manipulate the 'file_path' parameter. By uploading a specially crafted ZIP archive containing a media_metadata.json file, attackers can introduce path traversal sequences to read files outside the intended directory. This compromise can lead to the unauthorized exposure of sensitive data stored on the server, thus putting the site's security at risk.

References