Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104763 · Microsoft / collected KEV context

cve-program · CVE-2026-104763

• https://www.wordfence.com/threat-intel/vulnerabilities/id/71a6ba3d-0473-46c9-8040-b415807f4073?source=cve
• https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L575
• https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L573
• https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L982
• https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-media-handler.php#L500
• https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/
• https://plugins.trac.wordpress.org/changeset/3726363/post-export-import-with-media/trunk/includes/class-media-handler.php

No related operational record is retained in the current change model.