{"id":"CVE-2026-104763","revision":"697c64eb5a364c548544eab9f3b47b8f","records":[{"revision":"697c64eb5a364c548544eab9f3b47b8f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104763","aliases":[],"title":"Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json","description":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2.","state":0,"publishedAt":"2026-10-10T05:30:59.595+00:00","modifiedAt":"2026-10-11T16:55:17.696+00:00","affected":[{"ecosystem":"Vendor product","name":"Post Export Import with Media","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"wpazleen\",\n                    \"product\": \"Post Export Import with Media\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"1.17.1\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.9,"severity":"MEDIUM"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/71a6ba3d-0473-46c9-8040-b415807f4073?source=cve","https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L575","https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L573","https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L982","https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L500","https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/","https://plugins.trac.wordpress.org/changeset/3726363/post-export-import-with-media/trunk/includes/class-media-handler.php"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104763","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104763","identifiers":["CVE-2026-104763"]},"retained":false,"historicalAffected":[]}],"coverage":[]}