{"id":"CVE-2026-110268","kind":"vulnerability","aliases":["CVE-2026-110268"],"related":[],"title":"WordPress Post Export Import plugin: directory traversal via theme_slug parameter","description":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.","summary":"The Post Export Import with Media WordPress plugin up to and including 1.17.2 fails to restrict the theme_slug parameter, allowing path traversal. An authenticated administrator can act on files outside the intended directory.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed version of the Post Export Import with Media plugin in the WordPress admin plugin list or `wp plugin get <plugin-slug> --field=version`\n- Check whether the setting `peiwm_enable_admin_download_buttons` is enabled in the plugin settings","fix":"- Update the Post Export Import with Media plugin to a version later than `1.17.2` (the sources do not name the fixed version)\n- Disable the `peiwm_enable_admin_download_buttons` setting until patched","status":"open","published_at":"2026-10-17T04:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:32:53+00:00","updated_at":"2026-10-25T04:32:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:32:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Post Export Import with Media plugin to a version later than `1.17.2` (the sources do not name the fixed version)\n- Disable the `peiwm_enable_admin_download_buttons` setting until patched","reach":"internet","title":"WordPress Post Export Import plugin: directory traversal via theme_slug parameter","impact":"medium","summary":"The Post Export Import with Media WordPress plugin up to and including 1.17.2 fails to restrict the theme_slug parameter, allowing path traversal. An authenticated administrator can act on files outside the intended directory.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Administrator can read or act on files outside the intended directory","analyst_note":"Confirm the patched plugin version and whether the flaw allows reading or only modifying files, via the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed version of the Post Export Import with Media plugin in the WordPress admin plugin list or `wp plugin get <plugin-slug> --field=version`\n- Check whether the setting `peiwm_enable_admin_download_buttons` is enabled in the plugin settings","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Sites running the Post Export Import with Media plugin at version 1.17.2 or earlier that also have the peiwm_enable_admin_download_buttons setting turned on. Exploitation requires an administrator-level account, so sites with no admin accounts exposed to untrusted users carry lower practical risk.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3365,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110268':14A,17A '-2026':13A,16A '1.17.2':38B,81C 'access':98C 'act':53B 'action':103C 'admin':117C 'administr':51B,96C 'administrator-level':95C 'allow':46B 'attack':93C 'authent':50B,92C 'button':119C 'cve':12A,15A 'directori':6A,59B,72C,111C 'download':118C 'enabl':116C,123C 'exploit':112C 'export':3A,28B,62C 'fail':39B 'featur':120C 'file':55B,105C 'host':21B 'import':4A,29B,63C 'includ':37B,80C 'intend':58B,110C 'level':97C 'make':88C 'media':31B,65C 'origin':109C 'outsid':56B,106C 'packag':18B 'paramet':11A,45B,86C 'path':47B 'peiwm':115C 'perform':102C 'plugin':5A,25B,33B,66C,126C 'possibl':90C 'post':2A,27B,61C 'requir':113C 'restrict':41B 'self':20B 'self-host':19B 'set':127C 'slug':10A,44B,85C 'theme':9A,43B,84C 'travers':7A,48B,73C 'version':76C 'via':8A,82C 'vulner':70C 'wordpress':1A,22B,24B,32B,68C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Post Export Import with Media plugin at version 1.17.2 or earlier that also have the peiwm_enable_admin_download_buttons setting turned on. Exploitation requires an administrator-level account, so sites with no admin accounts exposed to untrusted users carry lower practical risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T04:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110268","severity":null,"published_at":"2026-10-17T04:16:52+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}