CVE-2026-110268: WordPress Post Export Import Plugin Traversal

CVE-2026-110268 Overview

CVE-2026-110268 is a directory traversal vulnerability [CWE-22] in the Post Export Import with Media plugin for WordPress. The flaw affects all versions up to and including 1.17.2 and resides in handling of the theme_slug parameter within class-admin-download-buttons.php. Authenticated attackers holding administrator-level privileges can traverse outside the intended plugin directory to read files on the host. Exploitation requires the peiwm_enable_admin_download_buttons setting to be enabled in the plugin configuration.

Critical Impact
Authenticated administrators can read arbitrary files outside the intended plugin directory on affected WordPress installations, exposing configuration and secrets stored on the server.

Affected Products

Post Export Import with Media plugin for WordPress, all versions through 1.17.2
WordPress sites with peiwm_enable_admin_download_buttons enabled
Shared hosting environments where multiple administrators manage a single WordPress instance

Discovery Timeline

2026-10-17 - CVE-2026-110268 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110268

Vulnerability Analysis

The Post Export Import with Media plugin exposes administrative download handlers in includes/class-admin-download-buttons.php. These handlers accept a theme_slug parameter supplied by the requesting user and concatenate it into a server-side file path without normalizing or validating directory separators. An authenticated administrator can supply traversal sequences such as ../ within theme_slug to escape the intended themes directory and reference arbitrary files on the WordPress host.

Because the vulnerable code path produces a download response, the attacker receives the targeted file contents. Impacted file paths include wp-config.php, log files, backup archives, and other sensitive artifacts readable by the web server user. The issue is tracked as a path traversal weakness under CWE-22.

Root Cause

The root cause is missing sanitization of the theme_slug request parameter prior to its use in filesystem operations at lines 251, 258, 357, and 360 of class-admin-download-buttons.php. The plugin trusts the slug string and does not restrict characters, enforce a base directory, or verify the resolved path remains inside the plugin's expected directory tree. See the WordPress Code Snippet at Line 251 for the vulnerable implementation.

Attack Vector

Exploitation requires administrator-level authentication to the target WordPress site and the peiwm_enable_admin_download_buttons feature enabled under plugin settings. The attacker issues a request to the plugin's download endpoint and injects a traversal payload into the theme_slug parameter. The server resolves the manipulated path and returns the targeted file. The attack is reachable over the network and does not require user interaction. For technical details see the Wordfence Vulnerability Report.

The vulnerability manifests when the download handler concatenates the attacker-controlled theme_slug value into a filesystem path without canonicalization. No verified public exploit code is published for CVE-2026-110268 at this time.

Detection Methods for CVE-2026-110268

Indicators of Compromise

HTTP requests to WordPress admin endpoints containing theme_slug parameters with ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences
Unexpected downloads of files such as wp-config.php, .htaccess, or system paths originating from the plugin's admin-download handler
Access log entries referencing class-admin-download-buttons.php with abnormally long or path-like theme_slug values

Detection Strategies

Inspect web server and WordPress audit logs for administrator sessions invoking the plugin's download buttons with suspicious slug values
Alert on responses from the plugin endpoint whose Content-Disposition header references filenames outside the themes directory
Correlate administrator account logins with subsequent download handler calls to spot credential misuse

Monitoring Recommendations

Enable WordPress audit logging and forward events to a centralized SIEM for retention and correlation
Monitor filesystem reads of sensitive artifacts such as wp-config.php by the PHP worker process
Track changes to the peiwm_enable_admin_download_buttons option in the WordPress options table

How to Mitigate CVE-2026-110268

Immediate Actions Required

Update the Post Export Import with Media plugin to the patched version released after 1.17.2
Disable the peiwm_enable_admin_download_buttons setting until the plugin is updated
Audit WordPress administrator accounts and rotate credentials for any account that may have been misused

Patch Information

The vendor addressed the traversal in WordPress Changeset 3749775, which modifies class-admin-download-buttons.php to validate the theme_slug input. Administrators should install the fixed release available in the WordPress Plugin Repository.

Workarounds

Deactivate the Post Export Import with Media plugin until patching is complete
Restrict WordPress administrator access to trusted personnel and enforce multi-factor authentication
Deploy a web application firewall rule that blocks theme_slug values containing traversal characters or absolute paths

bash

# Example WAF rule blocking traversal in theme_slug (ModSecurity syntax)
SecRule ARGS:theme_slug "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" \
    "id:1026110268,phase:2,deny,status:403,log,\
     msg:'CVE-2026-110268 path traversal attempt in theme_slug'"