EUVD-2026-103219
GHSA-4rjp-9x4j-xqhv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress admin access
-
DeliveryEnable/confirm admin download buttons feature
-
ExploitSubmit crafted theme_slug with traversal sequence
-
ExecutionPlugin resolves path outside theme directory
-
ImpactRead arbitrary server files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two specific conditions stated in the CVE: (1) the attacker must authenticate with administrator-level access or above (PR:H), and (2) the 'peiwm_enable_admin_download_buttons' feature must be explicitly enabled in the plugin settings - a non-default configuration gate that further narrows the exposed population. The vulnerable parameter is 'theme_slug', handled in includes/class-admin-download-buttons.php. The dominant limiting factor is the admin-only requirement: an attacker at this privilege level already controls the WordPress site, so realistic risk is confined to privilege-boundary edge cases (e.g., multisite or least-privilege admin separation) or post-compromise escalation. |
| Impact | This is a genuinely low-priority issue despite the CWE-22 (Directory Traversal) classification. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) is internally consistent with the description: PR:H reflects the explicit requirement for administrator-level access, and the network attack vector simply means the authenticated admin interacts over HTTP. The single most important mitigating signal is that an attacker must ALREADY hold administrator privileges on the WordPress site - a role that in WordPress legitimately has extensive file and configuration powers - which drastically reduces real-world impact. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or widespread interest. The reporting source (Wordfence) and the linked wordpress.org trac changeset confirm the flaw and the fix, but the signals do not conflict: a high-CVSS-component (C:H) is offset by the PR:H precondition and a non-default feature requirement. Net: a real but low-urgency finding, best handled through routine plugin updates rather than emergency patching. |
| Exploit ScenarioDerived | An authenticated administrator (or an attacker who has already compromised an admin account via phishing or credential reuse) on a site running Post Export Import with Media ≤1.17.2 with the admin download-buttons feature enabled submits a crafted 'theme_slug' value containing traversal sequences. The plugin resolves the path outside the intended theme directory, allowing the attacker to read or act on arbitrary files on the server. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 17, 2026
Authenticated administrator-level users of the WordPress plugin Post Export Import with Media through 1.17.2 can read files outside the intended export directory through the theme_slug parameter when the peiwm_enable_admin_download_buttons setting is enabled. The issue is a CWE-22 directory traversal rated CVSS 4.9 with confidentiality-only impact, and exploitation is gated by both administrator authentication and a non-default feature toggle. No public exploit was identified at time of analysis, and the admin-only prerequisite makes this a low-priority edge-case risk rather than a broadly exploitable path traversal.
RemediationAI
Upstream fix available via changeset 3749775 in trunk; a released patched version is not independently confirmed from the supplied data. Update the plugin as soon as a release after 1.17.2 is published and verified. Until then, disable the peiwm_enable_admin_download_buttons setting to remove the vulnerable download path, and restrict administrator-level accounts to trusted operators; on multisite, review super-admin separation because the issue requires high privileges. As compensating controls, block direct requests to the plugin's admin download endpoint and filter theme_slug for traversal sequences, accepting that encoded or alternate path payloads may evade simple WAF rules and that disabling the feature removes legitimate admin download buttons. Monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/061b1f95-26da-4d1a-9e0a-6f83adf56d2e?source=cve) and the changeset (https://plugins.trac.wordpress.org/changeset/3749775/post-export-import-with-media/trunk/includes/class-admin-download-buttons.php) for a fixed release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is in the WordPress plugin's includes/class-admin-download-buttons.php, where the theme_slug parameter is used to construct a file path for admin download actions. CWE-22 arises because user-controlled path input is not adequately canonicalized or constrained to the intended directory, allowing '../' style traversal to reach files outside the export directory. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N reflects network reachability but a high-privilege requirement and confidentiality-only impact. References point to lines 251, 258, 357, and 360 in tagged 1.17.1 and 1.17.2 copies, and changeset 3749775 in trunk appears to be the upstream code change; CPE cpe:2.3:a:wpazleen:post_export_import_with_media identifies the plugin.
Know when Post Export Import With Media gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Requires authenticated administrator access (PR:H) over HTTP (AV:N); traversal enables arbitrary file read (C:H) with no integrity or availability impact (I:N/A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
DescriptionNVD
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
PHP Object Injection in the Post Export Import with Media WordPress plugin (versions ≤1.17.1) allows authenticated admin
Remote code execution in the Post Export Import with Media WordPress plugin (all versions ≤ 1.13.1) is possible because
Authenticated directory traversal in the Post Export Import with Media plugin for WordPress through 1.17.1 allows admini
Exploit-DB