Arbitrary File Upload Vulnerability in WordPress Post Export Import with Media Plugin
CVE-2026-13430

7.2HIGH

Key Information:

Vendor

WordPress
Status
Post Export Import With Media
Vendor
CVE Published:
10 July 2026

What is CVE-2026-13430?

The Post Export Import with Media plugin for WordPress is vulnerable to an arbitrary file upload attack. This vulnerability arises from inadequate validation of file extensions, particularly due to a trailing-dot in filenames. The plugin's import_media_file_secure function improperly handles files when processing uploaded ZIP entries, allowing authenticated users with administrator-level access to upload potentially malicious executed files. This opens the door to remote code execution, posing significant security risks to affected WordPress installations.

Affected Version(s)

Post Export Import with Media 0 <= 1.13.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/post-export-im...
https://plugins.trac.wordpress.org/browser/post-export-im...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chloe Chamberland
PRISM
.