What is the CVSS score of CVE-2026-13430?

CVE-2026-13430 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Post Export Import with Media are affected by CVE-2026-13430?

The Post Export Import with Media WordPress plugin (versions ≤1.13.1) contains a remote code execution vulnerability (CVSS 7.2) that allows administrator-level users to bypass file upload…

How to fix or mitigate CVE-2026-13430?

24 hours: Inventory all WordPress installations running Post Export Import with Media (any version ≤1.13.1); document current versions and administrators with plugin access permissions. 7 days: Restrict media import functionality to verified business-critical administrators only; audit and document justifications for each enabled administrator account; disable the plugin if not actively used. 30 days: Monitor vendor security advisories for release of Post Export Import with Media version >1.13.1; prepare change control procedure for immediate deployment; establish automated version monitoring if supported by your WordPress management platform.

Post Export Import with Media CVE-2026-13430

EUVD-2026-42785 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-10 Wordfence

GHSA-mxq7-wpp5-2fc9

PHP WordPress RCE File Upload Wordpress Plugin Post Export Import With Media

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable AJAX endpoint with low complexity and no interaction, but requires existing admin access (PR:H); resulting webshell yields full C/I/A impact without scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 04:24 vuln.today

CVE Published

Jul 10, 2026 - 03:31 nvd

HIGH 7.2

DescriptionCVE.org

The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.13.1 via the import_media_file_secure function. This is due to insufficient file extension validation caused by a trailing-dot filename bypass, where the extension allow-list check in ajax_import_media_start() uses pathinfo() on the raw ZIP entry name (e.g., 'shell.php.'), which returns an empty string for the extension, causing the allow-list guard to be skipped and the file to be extracted to a temporary location, after which import_media_file_secure() copies it into the WordPress uploads directory without re-validating the extension. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.

AnalysisAI

Remote code execution in the Post Export Import with Media WordPress plugin (all versions ≤ 1.13.1) is possible because a trailing-dot filename bypass (e.g. 'shell.php.') defeats the extension allow-list in ajax_import_media_start(), letting an administrator-level user smuggle an executable PHP file into the uploads directory during a media import. Reported by Wordfence, the flaw carries CVSS 7.2 and has no public exploit identified at time of analysis; exploitation requires existing administrator (PR:H) access, making it primarily a hardening/defense-in-depth bypass rather than a mass-exploitable entry point.

Technical ContextAI

The vulnerability lives in the plugin's media-import path (class-media-handler.php). When a ZIP archive is imported, ajax_import_media_start() validates each entry's extension against an allow-list using PHP's pathinfo(). For a raw ZIP entry name like 'shell.php.' (a trailing dot), pathinfo() returns an empty string for PATHINFO_EXTENSION, so the guard treats the entry as having no disallowed extension and skips the check. The entry is extracted to a temporary location and then import_media_file_secure() copies it into the WordPress uploads directory without re-validating the extension. This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type), where reliance on string-parsing of an attacker-controlled filename creates a parser-differential: PHP's pathinfo() and the underlying filesystem/webserver disagree on the effective extension, and on many configurations 'shell.php.' is served/executed as PHP. The affected component is the wpazleen post_export_import_with_media plugin per CPE cpe:2.3:a:wpazleen:post_export_import_with_media:*.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - a WordPress plugin trac changeset (3600506, https://plugins.trac.wordpress.org/changeset?reponame=&old=3600506%40post-export-import-with-media&new=3600506%40post-export-import-with-media) indicates the code was corrected, but no tagged patched release above 1.13.1 is confirmed in the supplied data, so verify the fixed version against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/42f94f80-6157-4778-ad69-184943134fd2?source=cve) and update as soon as a release above 1.13.1 is published. As compensating controls until a confirmed patch: restrict who holds WordPress administrator accounts and enforce MFA on them to shrink the PR:H attacker pool; deactivate the Post Export Import with Media plugin if the media-import feature is not in active use (trade-off: import/export workflows stop working); and add a webserver rule denying PHP execution within wp-content/uploads (e.g. an .htaccess/nginx location block), which blocks execution of any smuggled .php file with the side effect of breaking any legitimate plugin that intentionally executes PHP from uploads (rare). Also set DISALLOW_FILE_EDIT to reduce the blast radius of a compromised admin.