CVE-2026-13430 affects the Post Export Import with Media plugin for WordPress in all versions up to and including 1.13.1. The vulnerability arises from insufficient validation of file extensions during the import process. Specifically, the ajax_import_media_start() function uses pathinfo() on raw ZIP entry names, which returns an empty string for extensions with trailing dots (e.g., 'shell.php.'). This causes the allow-list extension check to be bypassed, allowing files with dangerous types to be extracted to a temporary location. Subsequently, import_media_file_secure() copies these files into the WordPress uploads directory without re-validating their extensions, enabling authenticated administrators to upload arbitrary files that may be executable. This flaw can lead to remote code execution.

An attacker with administrator-level access can exploit this vulnerability to upload arbitrary files, including potentially executable code, to the WordPress uploads directory. This may result in remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious file uploads. Avoid using the affected plugin versions if possible.