CVE-2026-104764

7.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-502

Impact

Authenticated administrators can achieve remote code execution, arbitrary file deletion, or data exposure if a compatible POP chain exists in another installed plugin or theme. The attacker needs valid WordPress administrator credentials to inject the malicious serialized object.

Root cause

The plugin directly deserializes untrusted user input without sanitization in its page handler logic.

Affected systems

Post Export Import with Media plugin for WordPress through version 1.17.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a version newer than 1.17.1 once released, or deactivate and delete the plugin immediately if patching is not yet available.

shell

$ wp plugin deactivate post-export-import-with-media

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-104764