CVE-2026-13430: Post Export Import with Media Plugin Arbitrary File Upload (WordPress)

Technical summary

The vulnerability exists in the import_media_file_secure and ajax_import_media_start functions. When processing ZIP files, the plugin uses PHP's pathinfo() function to extract file extensions from ZIP entry names. A trailing dot causes pathinfo() to return an empty string for the extension, defeating the allow-list validation. The file is then extracted to a temporary location where the extension check is bypassed, and subsequently copied into the WordPress uploads directory (wp-content/uploads/) without re-validation. The root cause is dual-layer trust: the plugin assumes that if a file passes initial validation, it remains safe during file operations, and it relies on pathinfo() behavior that treats trailing dots as having no extension.

Business impact

Compromise of an administrator account, whether through social engineering, credential theft, or malicious insider action, could lead to arbitrary code execution on the web server. This enables attackers to deface sites, steal data, install backdoors, or pivot to internal networks. For WordPress installations hosting customer data, e-commerce transactions, or sensitive business operations, this could result in data breaches, operational downtime, and regulatory exposure (GDPR, PCI-DSS, etc.).

Affected systems

All versions of the Post Export Import with Media plugin up to and including version 1.13.1 are affected. The vulnerability requires WordPress administrator privileges to exploit. This affects WordPress sites running this plugin where administrator accounts may be at risk or where privilege escalation is a concern.

Exploitability

Exploitation requires administrator-level WordPress credentials, making this a high-privilege vulnerability. The attack surface is limited to users with upload and media import capabilities—typically site owners, administrators, or trusted team members. However, once an admin account is compromised or if a malicious insider has admin access, exploitation is straightforward and requires no user interaction. The trailing-dot bypass is reliable across platforms where pathinfo() exhibits this behavior.

Remediation

Update the Post Export Import with Media plugin to a patched version released after 1.13.1 (verify against the vendor advisory for the exact version number). The vendor should validate file extensions both before and after file operations, and should sanitize or normalize filenames to prevent trailing-dot bypasses. Until an update is available, restrict administrator role assignments to trusted personnel and monitor file uploads in the WordPress uploads directory for suspicious executable files.

Patch guidance

Check the plugin's official WordPress.org page or vendor website for a security update. Apply the patch immediately in a staging environment to verify compatibility with your site's configuration, then deploy to production. If no patch is available within a reasonable timeframe, consider disabling the plugin and using alternative media import methods, or restricting administrator access to a minimal set of trusted users.

Detection guidance

Monitor WordPress uploads directory (wp-content/uploads/) for unexpected executable files (.php, .phtml, .php3, .php4, .php5, .phar, etc.). Review administrator activity logs for unusual file import operations, particularly via the import_media_file_secure and ajax_import_media_start functions. Check server error logs for failed pathinfo() calls or file validation anomalies. Use WordPress security plugins (e.g., Wordfence, iThemes Security) to monitor file integrity and suspicious uploads.

Why prioritize this

Although the CVSS score is 7.2 (HIGH), the practical risk depends on your administrative access control posture. If administrator accounts are well-protected, internal, and monitored, this is a medium-priority patch. However, if administrator accounts are shared, widely distributed, or if you operate a multi-user WordPress environment where editor-level users can be escalated, this becomes critical. Prioritize patching if you cannot guarantee the integrity of all administrator accounts.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects HIGH severity due to the potential for remote code execution (CIA impact), no user interaction required once the attacker has admin access, and network-accessible attack vector. The score assumes a worst-case scenario where an admin account is compromised. However, the requirement for administrator-level privileges (PR:H) prevents this from reaching a critical score (8.0+). Organizations with strong administrative access controls and credential management may assess their practical risk as lower.

Frequently asked questions