CVE-2026-110268

Name of the Vulnerable Software and Affected Versions Post Export Import with Media versions prior to 1.17.3

Description The Post Export Import with Media plugin for WordPress contains a Directory Traversal flaw. This issue allows authenticated users with administrator-level access or higher to access and perform actions on files located outside the intended directory. The flaw is triggered via the theme slug parameter and requires the peiwm enable admin download buttons feature to be enabled within the plugin settings. Directory Traversal is a condition where an attacker can use special characters to escape the intended directory and access other files on the server.

Recommendations Update the plugin to a version newer than 1.17.2. Disable the peiwm enable admin download buttons feature in the plugin settings as a temporary mitigation measure.