Arbitrary File Upload in Post Export Import with Media WordPress Plugin

Executive Summary

The Post Export Import with Media plugin for WordPress has a vulnerability in versions up to and including 1.13.1 that allows arbitrary file uploads. This happens because the plugin's import_media_file_secure function does not properly validate file extensions due to a trailing-dot filename bypass. Specifically, the extension allow-list check uses pathinfo() on the raw ZIP entry name, which returns an empty string for filenames ending with a dot (e.g., 'shell.php.'). This causes the allow-list check to be skipped, allowing potentially dangerous files to be extracted and copied into the WordPress uploads directory without proper validation.

As a result, authenticated users with administrator-level access or higher can upload files that may be executable, enabling remote code execution on the affected WordPress site.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows authenticated administrators to upload arbitrary files that may be executable. This can lead to remote code execution, meaning an attacker could run malicious code on your WordPress server.

• Compromise of the website and server integrity.
• Potential unauthorized access to sensitive data.
• Defacement or disruption of website services.
• Use of the server as a launch point for further attacks.

Useful 0 Not Useful 0