Live › vulnerability › CVE-2026-110268
Go to dashboardThe Post Export Import with Media WordPress plugin up to and including 1.17.2 fails to restrict the theme_slug parameter, allowing path traversal. An authenticated administrator can act on files outside the intended directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Post Export Import with Media plugin at version 1.17.2 or earlier that also have the peiwm_enable_admin_download_buttons setting turned on. Exploitation requires an administrator-level account, so sites with no admin accounts exposed to untrusted users carry lower practical risk.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=versionpeiwm_enable_admin_download_buttons is enabled in the plugin settings1.17.2 (the sources do not name the fixed version)peiwm_enable_admin_download_buttons setting until patchedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.
This page as .md · .json · in your agent: get_signal("CVE-2026-110268")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.