{"id":"CVE-2026-104763","aliases":["EUVD-2026-96096","GHSA-vxwp-9pcg-465r"],"status":"published","title":"Post Export Import with Media \u003c= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json","description":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00732,"percentile":0.54761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-10-10T05:30:59Z","modified":"2026-10-13T13:30:21Z","products":[{"vendor":"wpazleen","product":"post export import with media"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71a6ba3d-0473-46c9-8040-b415807f4073?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L575"},{"url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L573"},{"url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L982"},{"url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L500"},{"url":"https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/"},{"url":"https://plugins.trac.wordpress.org/changeset/3726363/post-export-import-with-media/trunk/includes/class-media-handler.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104763"},{"url":"https://plugins.svn.wordpress.org/post-export-import-with-media/trunk"},{"url":"https://github.com/advisories/GHSA-vxwp-9pcg-465r"}],"sources":{"cve":[{"id":"CVE-2026-104763","title":"Post Export Import with Media \u003c= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json","description":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.","status":"published","published":"2026-10-10T05:30:59.595Z","modified":"2026-10-11T16:55:17.696Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-96096","description":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.","status":"published","published":"2026-10-10T05:30:59Z","modified":"2026-10-11T16:55:17Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:22.074542Z"}],"ghsa":[{"id":"GHSA-vxwp-9pcg-465r","title":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in...","description":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.","status":"published","published":"2026-10-10T06:30:59Z","modified":"2026-10-10T06:31:06Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:13:01.290603Z"}],"nvd":[{"id":"CVE-2026-104763","description":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.","status":"published","published":"2026-10-10T06:16:39.857Z","modified":"2026-10-13T13:30:21.62Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:55.473789Z"}]}}