CVE-2026-104763: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in wpazleen Post Export Import with Media

CVE-2026-104763 is a directory traversal vulnerability (CWE-22) in the Post Export Import with Media WordPress plugin affecting all versions up to and including 1.17.1. The flaw exists in the handling of the 'file_path' parameter within a media_metadata.json file inside a ZIP archive uploaded by an authenticated administrator. By including path traversal sequences and specifying allowed file extensions, an attacker can bypass extension guards and read arbitrary files on the server. This vulnerability requires administrator-level privileges and does not impact integrity or availability, only confidentiality.

An attacker with administrator-level access can read arbitrary files on the server by exploiting the directory traversal vulnerability. This can lead to disclosure of sensitive information stored on the server. There is no indication of impact on system integrity or availability. The vulnerability requires authenticated access with high privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrator access to trusted users only and monitor for suspicious activity related to ZIP archive uploads. Consider disabling or restricting the use of the Post Export Import with Media plugin if possible.