CVE-2026-13430

Name of the Vulnerable Software and Affected Versions Post Export Import with Media versions prior to 1.13.2

Description An arbitrary file upload issue exists due to insufficient file extension validation. The ajax import media start() function uses pathinfo() on raw ZIP entry names, which can be bypassed using a trailing-dot filename (e.g., 'shell.php.'). This bypass results in an empty string for the extension, skipping the allow-list check. Subsequently, the import media file secure() function copies the file into the WordPress uploads directory without further validation. Authenticated attackers with administrator-level access or higher can exploit this to upload executable files, potentially leading to remote code execution.

Recommendations Update to a version newer than 1.13.1. As a temporary workaround, restrict access to the import media file secure() function and the ZIP media import feature.