Security Alert Summary
The Post Export Import with Media plugin for WordPress contains an arbitrary file upload vulnerability that affects all versions up to and including 1.13.1. A specially crafted ZIP entry name with a trailing dot can bypass an extension allow-list check, allowing files to be extracted and copied into the WordPress uploads directory without proper re-validation. Authenticated users with administrator-level privileges can use this to place potentially executable files, creating a path to remote code execution.
CVE Details
- CVE ID: CVE-2026-13430
- Affected plugin / component: Post Export Import with Media plugin for WordPress
- Affected versions: All versions up to and including 1.13.1
- Published: July 10, 2026 at 4:17:47 AM UTC
- Last modified: July 10, 2026 at 3:43:30 PM UTC
- CVSS v3.1: Base Score 7.2 (HIGH) – Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Authentication / Privileges / User Interaction: Privileges Required: High (administrator-level or above); User Interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / Weakness ID: CWE-434
Technical Details
The vulnerability is an arbitrary file upload stemming from insufficient file extension validation. The plugin performs an allow-list check in ajax_import_media_start() using pathinfo() on the raw ZIP entry name. If a ZIP entry name includes a trailing dot (for example, “shell.php.”), pathinfo() returns an empty string for the extension, which causes the allow-list guard to be skipped. The file is then extracted to a temporary location and later copied into the WordPress uploads directory by import_media_file_secure() without re-validating the extension.
Because the extension check is bypassed and no subsequent validation occurs before placing the file in uploads, authenticated attackers with administrator-level access and above can upload files that may be executable. The described behavior makes remote code execution possible if an uploaded file is interpreted and executed by the server.
How This Could Impact Your Website
Consider a small organization where the site owner delegates content and media tasks to internal staff and an external contractor. An attacker who gains administrator-level credentials for any of those accounts could upload a file disguised with a trailing dot in its name and have that file copied into the uploads directory. This could allow execution of code on the server or the introduction of backdoors that persist beyond a single session.
Practical consequences include exposure of sensitive site functionality, potential unauthorized data access, and increased risk of targeted phishing or social engineering if attackers obtain internal user information. The risk is especially relevant for sites that grant administrator or high-privilege accounts to contractors or multiple staff members.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with administrator-level privileges or contributor rights that are not required.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and upload directories for unusual files or behavior.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.13.1/includes/class-media-handler.php#L268
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.13.1/includes/class-media-handler.php#L364
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.13.1/includes/class-media-handler.php#L389
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.13.1/includes/class-media-handler.php#L444
- https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.13.1/includes/class-media-handler.php#L789
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3600506%40post-export-import-with-media&new=3600506%40post-export-import-with-media
- https://www.wordfence.com/threat-intel/vulnerabilities/id/42f94f80-6157-4778-ad69-184943134fd2?source=cve
