CVE-2026-110268
CVE-2026-110268 · Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.
CVSS 4.9 · Medium · EPSS 0.8%
- Published
- Updated
Affected products and versions
post export import with media
- Versions
- ≥ 0, ≤ 1.17.2: Affected (semver)
No fix published
Original sources
- https://www.wordfence.com/threat-intel/vulnerabilities/id/061b1f95-26da-4d1a-9e0a-6f83adf56d2e?source=cve
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L251
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L360
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L360
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L251
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L258
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L357
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L258
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L357
- https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/
- https://plugins.trac.wordpress.org/changeset/3749775/post-export-import-with-media/trunk/includes/class-admin-download-buttons.php
- https://nvd.nist.gov/vuln/detail/CVE-2026-110268