CVE Feed

    Dashboard / CVE / CVE-2026-110268

    CVE-2026-110268

    The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.

    Published:Oct 17, 2026
    Last Modified:Oct 21, 2026
    EPS:Oct 17, 2026
    EPSS Score:0.00766
    CVSS Score:4.9

    Affected Products

    Vendor
    Wordpress-extensions
    Product
    Post Export Import With Media
    Vendor
    Wpazleen
    Product
    Post Export Import With Media

    Exploits

    No exploit reference

    References

    https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/
    https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L251
    https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L258
    https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L357
    https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L360
    https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L251
    https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L258
    https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L357
    https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L360
    https://plugins.trac.wordpress.org/changeset/3749775/post-export-import-with-media/trunk/includes/class-admin-download-buttons.php
    https://www.wordfence.com/threat-intel/vulnerabilities/id/061b1f95-26da-4d1a-9e0a-6f83adf56d2e?source=cve

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High