CVE-2026-13430 is a vulnerability in the Post Export Import with Media WordPress plugin affecting all versions up to and including 1.13.1. The issue arises from insufficient validation of file extensions during media import. Specifically, the allow-list check in ajax_import_media_start() uses pathinfo() on raw ZIP entry names, which returns an empty string for extensions with trailing dots (e.g., 'shell.php.'). This causes the extension check to be bypassed, allowing files with dangerous types to be extracted and copied into the WordPress uploads directory without re-validation. Authenticated users with administrator privileges can exploit this to upload arbitrary files, potentially leading to remote code execution.

Successful exploitation allows an authenticated administrator-level attacker to upload arbitrary files, including executable ones, to the WordPress uploads directory. This can result in remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious file uploads. Avoid using the affected plugin versions if possible.