CVE-2026-104764: CWE-502 Deserialization of Untrusted Data in wpazleen Post Export Import with Media

CVE-2026-104764 is a deserialization of untrusted data vulnerability (CWE-502) in the WordPress plugin Post Export Import with Media affecting versions up to 1.17.1. It allows authenticated administrators to inject PHP objects during deserialization. However, no gadget chain is present in the plugin itself, so exploitation requires another plugin or theme with a POP chain installed on the same site. The presence of such a chain could enable arbitrary file deletion, sensitive data retrieval, or code execution depending on the chain's capabilities.

If exploited in an environment where a suitable POP chain exists, an attacker with administrator privileges could perform high-impact actions including arbitrary file deletion, sensitive data exposure, or remote code execution. Without a POP chain, this vulnerability does not lead to impact. The vulnerability requires high privileges (administrator or above) and network access to the WordPress site.

No official patch or fix is currently documented. Since exploitation requires a POP chain from other plugins or themes, reviewing and limiting installed plugins/themes to trusted sources may reduce risk. Administrators should monitor vendor advisories for updates or patches. Because this vulnerability requires administrator access, enforcing strong access controls and limiting administrator accounts is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.