Logo
Retour à la veille

CVE-2026-110268

Publié : 17 octobre 2026
Modifié : 17 octobre 2026
Lien officiel NVD
Score CVSS
4.9
MEDIUM

Description détaillée

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally intended directory. Exploitation requires the peiwm_enable_admin_download_buttons feature to be enabled in the plugin settings.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://plugins.svn.wordpress.org/post-export-import-with-media/trunk/https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L251https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L258https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L357https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.1/includes/class-admin-download-buttons.php#L360https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L251https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L258https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L357https://plugins.trac.wordpress.org/browser/post-export-import-with-media/tags/1.17.2/includes/class-admin-download-buttons.php#L360https://plugins.trac.wordpress.org/changeset/3749775/post-export-import-with-media/trunk/includes/class-admin-download-buttons.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/061b1f95-26da-4d1a-9e0a-6f83adf56d2e?source=cve

Dernières Vulnérabilités

CVE-2026-110384

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.

VOIR DÉTAILS

CVE-2026-97314

The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.

VOIR DÉTAILS

CVE-2026-92433

The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.

VOIR DÉTAILS