CVE-2026-110268 wpazleen CVE debrief

Who should care

WordPress administrators and security teams should assess exposure and verify plugin versions to mitigate potential risks. This includes reviewing the plugin settings, ensuring the peiwm_enable_admin_download_buttons feature is not enabled if not required, and monitoring for suspicious file access patterns. Additionally, security teams should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-110268 is a Directory Traversal vulnerability in the Post Export Import with Media plugin for WordPress. It allows authenticated attackers with administrator-level access to perform actions on files outside the intended directory when a specific feature is enabled. WordPress administrators and security teams should assess exposure and verify plugin versions.

• Verify plugin version and update to a fixed version if available
• Restrict administrator access to the plugin settings
• Monitor for suspicious file access patterns

Technical summary

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.17.2. The vulnerability is due to insufficient validation of the 'theme_slug' parameter and requires the peiwm_enable_admin_download_buttons feature to be enabled. This allows authenticated attackers with administrator-level access to perform actions on files outside the intended directory, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS score of 4.9 and is classified as MEDIUM severity.

Defensive priority

Assess exposure and verify plugin version; restrict administrator access; monitor for suspicious file access

Recommended defensive actions

• Verify plugin version and update to a fixed version if available
• Restrict administrator access to the plugin settings
• Monitor for suspicious file access patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

CVE and NVD records indicate a Directory Traversal vulnerability in Post Export Import with Media plugin versions up to 1.17.2. The vulnerability requires administrator-level access and the peiwm_enable_admin_download_buttons feature to be enabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.