CVE-2026-110268: Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwmenableadmindownloadbuttons feature to be enabled in the plugin settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the peiwm_enable_admin_download_buttons feature in the plugin settings.
Post Export Import with Media peiwm_enable_admin_download_buttons = disabled
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to WordPress with administrator-level privileges or higher. The issue is therefore primarily relevant where administrator accounts are compromised, shared, or granted to untrusted users.
Is the default plugin configuration affected?
Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings. If that feature is not enabled, the described exploitation condition is not met.
Which installations are affected?
All Post Export Import with Media versions up to and including 1.17.2 are affected, provided the required admin download buttons feature is enabled.
What can an attacker do after exploiting the issue?
A qualifying administrator can use the theme_slug parameter to perform actions on files outside the directory the plugin intended to restrict them to. The available information does not specify which file actions or paths are possible.