Threat database

The Post Export Import with Media WordPress plugin up to version 1.17.2 contains a directory traversal vulnerability via the 'theme_slug' parameter. This vulnerability allows authenticated users with administrator-level privileges or higher to access files outside the intended directory if the 'peiwm_enable_admin_download_buttons' feature is enabled. The vulnerability has a medium severity rating with a CVSS score of 4.9.

The Post Export Import with Media WordPress plugin up to version 1.17.1 is vulnerable to PHP Object Injection via deserialization of untrusted data. This vulnerability requires an attacker to have administrator-level access. Exploitation depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes. Without such a POP chain, the vulnerability has no impact. If a POP chain exists, attackers may delete files, access sensitive data, or execute code.

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin up to version 3.10.0 contains a critical privilege escalation vulnerability. An unauthenticated attacker can exploit a missing capability check in an AJAX action and a flawed exclusion list in user meta saving to create a new Administrator-level account. The required nonce is publicly exposed on all front-end pages, making exploitation trivial. This vulnerability allows full control over the WordPress site without authentication.

The Post Export Import with Media plugin for WordPress contains a directory traversal vulnerability in all versions up to and including 1.17.1. Authenticated users with administrator-level privileges can exploit this flaw by uploading a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the 'file_path' parameter. This allows reading arbitrary files on the server, potentially exposing sensitive information. The vulnerability bypasses extension checks introduced in version 1.13.2. The CVSS score is 4.9, indicating medium severity.

The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.13.1 via the import_media_file_secure function. This is due to insufficient file extension validation caused by a trailing-dot filename bypass, where the extension allow-list check in ajax_import_media_start() uses pathinfo() on the raw ZIP entry name (e.g., 'shell.php.'), which returns an empty string for the extension, causing the allow-list guard to be skipped and the file to be extracted to a temporary location, after which import_media_file_secure() copies it into the WordPress uploads directory without re-validating the extension. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.