Directory Traversal Vulnerability in Post Export Import with Media Plugin for WordPress

CVE-2026-110268

What is CVE-2026-110268?

The Post Export Import with Media plugin for WordPress is susceptible to a Directory Traversal vulnerability that allows authenticated users with administrator-level access to manipulate and access files outside of the designated directory. This exploit hinges on the 'theme_slug' parameter and is only possible when the 'peiwm_enable_admin_download_buttons' feature is activated in the plugin settings. Users should be aware of this risk to ensure proper security measures are implemented.

References