CVE-2026-104763: WordPress Post Export Import Path Traversal

CVE-2026-104763 Overview

CVE-2026-104763 is a directory traversal vulnerability [CWE-22] in the Post Export Import with Media plugin for WordPress. The flaw affects all versions up to and including 1.17.1 and is reachable through the file_path parameter. Authenticated attackers with administrator-level privileges can read arbitrary files on the server by uploading a crafted ZIP archive that contains a media_metadata.json file with path traversal sequences. The attack specifies an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2, enabling exposure of sensitive configuration and credential files.

Critical Impact
Authenticated administrators can read arbitrary files on the WordPress host, including configuration files such as wp-config.php containing database credentials and secret keys.

Affected Products

WordPress Post Export Import with Media plugin, all versions through 1.17.1
WordPress installations where the plugin is installed and active
Multi-site WordPress deployments where administrators share plugin access

Discovery Timeline

2026-10-10 - CVE-2026-104763 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104763

Vulnerability Analysis

The vulnerability resides in the media import workflow implemented in class-media-handler.php. When processing an imported ZIP archive, the plugin reads the media_metadata.json manifest and uses the file_path field to determine where to read source media from on disk. The handler does not canonicalize or constrain the resolved path to the intended uploads directory. An attacker-supplied file_path containing ../ sequences escapes the import root and resolves to arbitrary locations on the server filesystem.

Version 1.13.2 added an extension allowlist intended to restrict operations to media file types. That guard is applied to the destination filename rather than the source path. By declaring an allowed extension for the destination while pointing file_path at an arbitrary file, an attacker reads any file the PHP process can access.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The plugin trusts attacker-controlled metadata from the uploaded archive and resolves file_path without validating that the normalized path remains inside the expected import directory. The extension check runs on an unrelated string, so it does not block traversal attempts.

Attack Vector

Exploitation requires administrator-level authentication and the ability to invoke the plugin's import function. The attacker crafts a ZIP archive containing a media_metadata.json entry whose file_path value uses ../ sequences to point outside the uploads directory. The destination filename within the archive uses an allowed media extension to satisfy the post-1.13.2 extension guard. On import, the plugin reads the targeted file and exposes its contents through the import process, enabling disclosure of files such as wp-config.php, SSH keys, or application logs. See the Wordfence Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-104763

Indicators of Compromise

ZIP uploads to the plugin's import endpoint that contain a media_metadata.json entry with ../ or absolute path sequences in the file_path field.
WordPress admin-ajax or admin-post requests invoking the plugin's import handler from unexpected administrator accounts or IP addresses.
Unexpected read access by the PHP worker process to files outside the wp-content/uploads/ directory tree, such as wp-config.php or /etc/passwd.

Detection Strategies

Inspect uploaded ZIP archives server-side and flag any media_metadata.json whose file_path fails to normalize inside the designated import directory.
Review WordPress audit logs for administrator sessions that trigger the Post Export Import with Media import routine, correlating with session origin and user-agent anomalies.
Scan web server access logs for POST requests to the plugin's import URLs followed by error responses or large response bodies indicating file content retrieval.

Monitoring Recommendations

Alert on filesystem reads of sensitive WordPress files such as wp-config.php, .htaccess, and private key files by the webserver user.
Monitor administrator account creation, privilege changes, and successful logins from new geographic locations given the privileged prerequisites for this flaw.
Track plugin version inventory across managed WordPress sites and generate alerts when installations remain at 1.17.1 or earlier.

How to Mitigate CVE-2026-104763

Immediate Actions Required

Update the Post Export Import with Media plugin to the fixed version released after 1.17.1, as published in the WordPress Changeset Update.
Rotate secrets stored in wp-config.php, including database credentials and WordPress authentication keys, if the plugin ran on an internet-exposed site before patching.
Audit the WordPress administrator account list and remove or disable any accounts that are not required for daily operations.

Patch Information

The vendor committed a fix in changeset 3726363 to class-media-handler.php. The patch tightens path handling in the media import routine so that attacker-controlled file_path values cannot resolve outside the import directory. Review the updated source in the WordPress Plugin Repository and confirm the installed version reflects the post-1.17.1 release.

Workarounds

Deactivate and remove the Post Export Import with Media plugin until the patched release is installed on all managed sites.
Restrict WordPress administrator access using multi-factor authentication and IP allowlisting to limit the pool of users who can reach the vulnerable import function.
Deploy web application firewall rules that inspect ZIP uploads to the plugin endpoint and block archives whose JSON metadata contains ../ sequences in file_path values.

bash

# Configuration example: identify installations still exposed to CVE-2026-104763
wp plugin get post-export-import-with-media --field=version
wp plugin deactivate post-export-import-with-media
wp plugin update post-export-import-with-media