CVE-2026-13430: WordPress Post Export Import Plugin RCE Flaw

CVE-2026-13430 Overview

CVE-2026-13430 is an arbitrary file upload vulnerability in the Post Export Import with Media plugin for WordPress. All versions up to and including 1.13.1 are affected. The flaw resides in the import_media_file_secure function, where a trailing-dot filename bypass defeats extension allow-list validation. Authenticated attackers with administrator-level privileges can upload executable files, resulting in remote code execution (RCE) on the underlying WordPress host. The vulnerability is tracked as [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated administrators can upload PHP files disguised with trailing-dot extensions, achieving remote code execution and full compromise of the WordPress server.

Affected Products

Post Export Import with Media plugin for WordPress
All versions up to and including 1.13.1
WordPress sites with the plugin installed and activated

Discovery Timeline

2026-07-10 - CVE-2026-13430 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-13430

Vulnerability Analysis

The vulnerability originates in the ajax_import_media_start() handler of the Post Export Import with Media plugin. When processing a ZIP archive, the code enumerates archive entries and validates each entry's file extension against an allow-list. The allow-list guard relies on PHP's pathinfo() function against the raw ZIP entry name.

An attacker who crafts a ZIP entry named shell.php. (with a trailing dot) causes pathinfo() to return an empty string for the extension component. The allow-list check compares this empty value against the permitted extensions, and because no positive match is required to proceed, the guard is effectively skipped.

After extension validation is bypassed, the entry is extracted to a temporary location. Control then passes to import_media_file_secure(), which copies the extracted file into the WordPress uploads directory. This function does not re-validate the extension, allowing PHP files to land in a web-accessible path where they can be requested and executed by the web server.

Root Cause

The root cause is insufficient input validation on ZIP archive entry names, combined with reliance on pathinfo() semantics that treat trailing-dot names as having no extension. The absence of a secondary extension check in import_media_file_secure() compounds the flaw.

Attack Vector

Exploitation requires authenticated access at the administrator level or higher. The attacker uploads a crafted ZIP containing a file such as shell.php. through the plugin's import functionality. Once extracted into the uploads directory, the attacker requests the file through the web server to execute arbitrary PHP code. See the Wordfence Vulnerability Analysis and the vulnerable WordPress Media Handler Code for technical details.

Detection Methods for CVE-2026-13430

Indicators of Compromise

Files with unusual trailing-dot names such as *.php. inside plugin-managed ZIP imports or the WordPress uploads directory.
New or unexpected PHP files under wp-content/uploads/ that do not match legitimate media types.
Web server access log entries requesting PHP files located within the uploads directory.
Recent invocations of the plugin's ajax_import_media_start AJAX action in access logs.

Detection Strategies

Scan the uploads directory for executable file extensions (.php, .phtml, .phar) that should never appear there.
Inspect ZIP archives processed by the plugin for entries containing trailing dots or unusual characters in filenames.
Correlate administrator login events with subsequent plugin import activity and file creation in uploads.
Review WordPress audit logs for use of the Post Export Import with Media plugin by any administrator account.

Monitoring Recommendations

Enable file integrity monitoring (FIM) on wp-content/uploads/ and plugin directories to alert on new PHP files.
Forward WordPress and web server logs to a centralized SIEM for correlation across authentication and file-write events.
Monitor outbound network connections from the PHP-FPM or web server process for signs of post-exploitation activity.
Alert on POST requests to admin-ajax.php invoking plugin-specific actions from newly authenticated administrator sessions.

How to Mitigate CVE-2026-13430

Immediate Actions Required

Update the Post Export Import with Media plugin to a version later than 1.13.1 once released, per the WordPress Plugin Change Set.
Deactivate and remove the plugin on any site where an updated release is not yet available.
Audit administrator accounts and rotate credentials for any account that may have been compromised.
Inspect wp-content/uploads/ for unauthorized PHP files and remove any that are not legitimate media assets.

Patch Information

The vendor addressed the flaw in a subsequent release tracked by the WordPress Plugin Change Set. Administrators should upgrade to the fixed version and confirm the plugin metadata reflects a release higher than 1.13.1. Refer to the Wordfence Vulnerability Analysis for patch validation guidance.

Workarounds

Restrict administrator access to trusted personnel and enforce multi-factor authentication on all WordPress admin accounts.
Configure the web server to deny execution of PHP files inside wp-content/uploads/ using an Apache .htaccess or Nginx location directive.
Deploy a web application firewall (WAF) rule that blocks ZIP uploads containing filenames with trailing dots or double extensions.
Temporarily disable the plugin's import functionality until the site is patched.

bash

# Nginx configuration to block PHP execution in the uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}