Post Export Import EUVD-2026-100912

Exploitation requires two concurrent prerequisites: (1) the attacker must hold administrator-level (or higher) WordPress access, matching the CVSS PR:H rating, and (2) a separate plugin or theme containing a usable PHP POP gadget chain must be installed on the same site - the vulnerable Post Export Import with Media plugin (versions ≤1.17.1) contains no POP chain itself, so without an external gadget the object injection has no security impact. The limiting factors are therefore significant: administrator authentication is required (no anonymous or low-privilege path), and impact is entirely contingent on the co-presence of a third-party gadget chain, making default, minimally-configured installations effectively non-exploitable.

This is a genuine but conditional and lower-priority issue despite the 7.2 (High) CVSS score. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N) describes a network-reachable, low-complexity flaw, but the PR:H requirement is decisive: exploitation requires administrator-level access, meaning the attacker is already the highest-privileged user of the WordPress site. More importantly, the description explicitly states there is NO known POP (property-oriented programming) chain in the vulnerable plugin itself, so the PHP Object Injection has no impact on its own - a separate vulnerable plugin or theme containing a usable gadget chain must also be installed for the C:H/I:H/A:H impacts to materialize. This dependency makes the real-world severity substantially lower than the raw score suggests and is not fully reflected in the CVSS AC:L rating. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis, and the flaw is not in CISA KEV. The combination of admin-only access plus a required external gadget chain means practical exploitation is narrow and opportunistic rather than widespread. Note the apparent tension: CVSS marks AC:L, yet the need for a co-resident POP chain is effectively an added attack requirement that argues for higher complexity - this is a data nuance defenders should weigh.

An attacker who has already obtained WordPress administrator credentials (via phishing, credential reuse, or a separate privilege escalation) submits crafted serialized data to an affected import/export handler, causing the plugin to deserialize untrusted input and instantiate arbitrary PHP objects. If a separate installed plugin or theme provides a usable POP gadget chain, the injected object can trigger file deletion, sensitive data retrieval, or remote code execution. No public exploit code was identified at time of analysis, and the attack is network-reachable (AV:N) with low technical complexity once admin access and a gadget chain are both present.