CVE-2026-104764

Deferred Deferred - Pending Action

PHP Object Injection in Post Export Import with Media WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104764

EUVD

EUVD-2026-100912

Affected Vendors & Products

Vendor	Product	Version / Range
wpazleen	Post	Export Import with Media 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a PHP Object Injection flaw in the Post Export Import with Media WordPress plugin affecting versions up to 1.17.1. It allows authenticated attackers with administrator access or higher to inject a PHP object via deserialization of untrusted input. The impact depends on other plugins or themes with a POP chain being present on the site.

Detection Guidance

This vulnerability requires authenticated access with administrator-level privileges to exploit. To detect it, check for unauthorized PHP object injection attempts in server logs or WordPress activity. Review plugins for the Post Export Import with Media plugin version 1.17.1 or lower. Use commands like 'grep -r "unserialize" /var/www/' to search for deserialization calls in plugin files.

Impact Analysis

If exploited, this vulnerability could allow attackers to delete arbitrary files, retrieve sensitive data, or execute code on the affected WordPress site. However, this requires another plugin or theme with a POP chain to be installed on the system for full exploitation.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA if an attacker exploits it to retrieve sensitive data or execute code. Exploitation requires administrator-level access and another plugin with a POP chain. If exploited, it could lead to unauthorized data access or modification, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately update the Post Export Import with Media plugin to the latest version beyond 1.17.1. Remove or disable the plugin if updates are unavailable. Restrict administrator-level access to trusted users only. Monitor for suspicious activity and review server logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-104764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70