CVE-2026-104764 wpazleen CVE debrief

Who should care

Administrators and security teams of WordPress installations with the Post Export Import with Media plugin should assess exposure and prioritize mitigation. This includes reviewing the plugin version, checking for the presence of a POP chain in other installed plugins or themes, and ensuring that only trusted users have administrator-level access. Additionally, security teams should consider implementing compensating controls and monitoring for potential

Why it matters

CVE-2026-104764 allows authenticated administrators to inject PHP objects, potentially leading to severe impacts if a POP chain is present via another plugin or theme. Defenders should verify exposure, assess POP chain presence, and prioritize mitigation.

• Potential for arbitrary file deletion if a POP chain is present.
• Possible retrieval of sensitive data if exploited in conjunction with a POP chain.
• Potential for code execution depending on the POP chain present via another plugin or theme.
• Verification of POP chain presence in other installed plugins or themes is necessary to determine full impact.

Technical summary

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection due to deserialization of untrusted input. This requires administrator-level access and above. No known POP chain is present in the vulnerable software, meaning the impact is dependent on the presence of another plugin or theme with a POP chain. The vulnerability exists in versions up to and including 1.17.1. To exploit this vulnerability, an attacker must have administrator-level access and above. The impact of this vulnerability is dependent on the presence of a POP chain in another plugin or theme installed on the site. If a POP chain is present, it could allow an attacker to perform actions such as delete arbitrary

Defensive priority

Administrators of WordPress installations with the Post Export Import with Media plugin should verify if a POP chain is present via other installed plugins or themes and prioritize updating or mitigating the vulnerability.

Recommended defensive actions

• Verify if the Post Export Import with Media plugin version is 1.17.1 or earlier and update to a patched version if available.
• Check for the presence of a POP chain via other installed plugins or themes that could be exploited in conjunction with this vulnerability.
• Monitor administrator-level access and ensure that only trusted users have such privileges.
• Consider implementing additional security measures such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in versions up to 1.17.1 of the Post Export Import with Media plugin and the potential impact if a POP chain is present.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.