PHP Object Injection Vulnerability in Post Export Import with Media Plugin for WordPress

CVE-2026-104764

What is CVE-2026-104764?

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted input in all versions up to and including 1.17.1. This vulnerability allows authenticated attackers with administrator-level access to exploit the deserialization flaw to inject a PHP object. It's important to note that the presence of a PHP Object Injection exploit (POP chain) in other installed plugins or themes is required for effective exploitation. Should a POP chain be present, attackers could potentially execute malicious actions such as deleting files, accessing sensitive information, or running unauthorized code.

References