Post Export Import CVE-2026-104763

Requires WordPress administrator-level (or higher) authentication on the target site running Post Export Import with Media <= 1.17.1. The attacker must upload a crafted ZIP archive whose media_metadata.json contains path-traversal sequences in the 'file_path' field AND specifies an allowed destination file extension to bypass the extension guard added in version 1.13.2. Limiting factors: the PR:H administrator requirement is the dominant constraint (attacker already holds top application privilege), impact is read-only disclosure (no write/integrity or availability effect), and sites on versions prior to 1.13.2 lack even the extension guard while patched versions after 1.17.1 remediate the flaw.

This is a moderate-severity issue (CVSS 4.9) whose real-world priority is materially reduced by the CVSS vector's PR:H requirement: exploitation demands existing WordPress administrator-level access. While the vector is AV:N/AC:L (network-reachable, low complexity once authenticated) with C:H (arbitrary file read), the administrator precondition means an attacker must already hold the highest application privilege level, so this is primarily a privilege-boundary / defense-in-depth concern (an admin reading OS files like wp-config.php secrets, or files outside the web app) rather than a path to initial compromise. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit code referenced - so there is no public exploit identified at time of analysis. The signals are internally consistent: a high-privilege, read-only (I:N/A:N) information-disclosure flaw reported by Wordfence with source links to the exact vulnerable code lines. No conflicting data; the main caveat is the absence of EPSS, which prevents a quantitative exploitation-probability comparison.

An attacker who has obtained WordPress administrator access (e.g., via a compromised or rogue admin account, or in a multi-admin environment) crafts a malicious ZIP import archive containing a media_metadata.json whose file_path field holds path-traversal sequences (../) while naming an allowed file extension for the destination to defeat the 1.13.2 extension guard. Importing this archive causes the plugin to read an arbitrary server file such as wp-config.php, exposing database credentials and secret keys. No public exploit code is referenced in the provided intelligence.