{"schema":"threatline.record/2","record":{"id":"CVE-2026-110268","aliases":[],"summary":"Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter","details":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.","categories":["Unclassified"],"product":"Post Export Import with Media","vendor":"wpazleen","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110268","source_modified_at":"2026-10-18T11:22:47.553Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Post Export Import with Media","vendor":"wpazleen","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.17.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":4.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00766,"percentile":0.55043,"score_date":"2026-10-23"},"published_at":"2026-10-17T03:43:26.196Z","modified_at":"2026-10-18T11:22:47.553Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110268","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-18T11:22:47.553Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110268","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/061b1f95-26da-4d1a-9e0a-6f83adf56d2e?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L251"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L360"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L360"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L251"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L258"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L357"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L258"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L357"},{"source":"CVE List","url":"https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3749775/post-export-import-with-media/trunk/includes/class-admin-download-buttons.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-18T11:09:22.551509Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-18T11:22:47.553Z","content_hash":"e09539a4fc7955d3380a6f2f6994555106165c89cd24522fc7a6f15c396f02b8"}}