CVE-2026-104763: Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a mediametadata.json file with path traversal sequences in the filepath field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with administrator-level access or higher can exploit it. The attack is therefore most relevant where administrator accounts are compromised, shared, improperly granted, or accessible to untrusted users.
What does an attacker need to provide to exploit it?
The attacker must upload a crafted ZIP archive containing a media_metadata.json file. The file_path field must contain path-traversal sequences, and the destination filename must use an allowed file extension to bypass the extension guard introduced in version 1.13.2.
What is the impact of successful exploitation?
A successful attacker can read arbitrary files from the server. Those files may contain sensitive information, while the provided data does not indicate integrity or availability impact.