CVE-2026-110268

Executive Summary

CVE-2026-110268 is a directory traversal vulnerability (CWE-22) in the "Post Export Import with Media" WordPress plugin, affecting all versions up to and including 1.17.2. An authenticated attacker holding administrator-level access or above can abuse the theme_slug parameter to operate on files outside the intended directory, resulting in unauthorized read of sensitive files when the peiwm_enable_admin_download_buttons feature is enabled in the plugin settings. The impact is confidentiality-only (CVSS 4.9), gated by both high privileges and a non-default configuration flag, which substantially constrains real-world exploitation.

Technical Analysis

The flaw resides in the plugin's handling of a user-supplied path component — specifically the theme_slug parameter — that is used to construct a filesystem path. Per the NVD description, the plugin fails to properly restrict this parameter to the intended directory, allowing directory traversal so that actions are performed on files "outside of the originally intended directory." This is the canonical CWE-22 pattern: untrusted input flows into a path operation without correct canonicalization and traversal-sequence (../) rejection.

Two preconditions materially reduce the attack surface:

1. Privilege requirement. The attacker must already authenticate with administrator-level access "and above." This is a post-authentication, high-privilege flaw (CVSS PR:H). It is not an unauthenticated entry point.
2. Configuration dependency. Exploitation "requires the peiwm_enable_admin_download_buttons feature to be enabled." If that setting is off, the vulnerable code path is not reachable.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confirms the impact profile: confidentiality High, integrity None, availability None, scope unchanged. The vulnerability enables reading of files outside the target directory, not modification or deletion.

Because the NVD description does not disclose the exact file, function, or sink, the specific traversal sink and the precise scope of what can be read (e.g., whether reads are bounded to the WordPress root or can escape to arbitrary absolute paths) cannot be confirmed from available data. No public PoC, exploit code, or Nuclei template exists, and the vendor/product fields were recorded as Unknown, indicating this is a low-attention, recently catalogued CVE.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the parameters/preconditions named in the NVD description.

1. Reconnaissance / target identification. An attacker who already holds (or has compromised) a WordPress administrator account enumerates installed plugins and identifies "Post Export Import with Media" at version ≤ 1.17.2. They verify the peiwm_enable_admin_download_buttons feature is enabled — without it the traversal is not reachable.

2. Triggering the flaw class. The attacker submits a crafted request in which the theme_slug parameter contains traversal sequences (directory traversal, ../) so that the resolved path escapes the "originally intended directory." In a CWE-22 flaw of this type, the absence of canonicalization plus insufficient ../ filtering is what allows the path operation to reach files outside the intended location.

3. Payload / execution method (class level). Rather than remote code execution, this is an information-disclosure traversal: the attacker uses the download-manipulation feature (enabled via peiwm_enable_admin_download_buttons) to cause the plugin to act on a file outside the intended directory and disclose its contents. The specific file types reachable are not documented.

4. Post-exploitation impact. Successful traversal yields unauthorized reads (CVSS C:H). Because the attacker is already an administrator, the practical value is escalation from "administrator with normal content/DB access" to "read files the web server can access but the admin UI normally cannot" — e.g., secrets or configuration material outside the plugin directory that could support further persistence or lateral movement. No integrity or availability impact is documented.

Impact Assessment

Business impact is limited but non-trivial: this is a high-privilege, configuration-gated confidentiality flaw. Blast radius is constrained because PR:H (administrator+) means the attacker must already control a privileged account; the CVE is primarily relevant as a post-compromise or malicious-insider tool for reading files beyond the plugin's intended directory. AV:N/AC:L/UI:N indicate low complexity and no user interaction, so once an admin session exists, exploitation is straightforward. S:U (unchanged scope) and I:N/A:N bound the damage to disclosure only. Overall severity score 4.9 (Medium). No evidence of CISA KEV listing, active in-the-wild exploitation, or EPSS scoring.

Detection Guidance

Sigma Rule

title: WordPress Post Export Import with Media Directory Traversal (CVE-2026-110268)
id: 8f3a2c11-7d4e-4b9a-9c1f-peiwm110268
status: experimental
description: Detects traversal sequences in the theme_slug parameter targeting the Post Export Import with Media plugin
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110268
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_plugin:
    cs-method: 'GET'
    cs-uri-query|contains:
      - 'theme_slug='
  selection_traversal:
    cs-uri-query|contains:
      - 'theme_slug=../'
      - 'theme_slug=..%2f'
      - 'theme_slug=%2e%2e%2f'
      - 'theme_slug=..%5c'
      - 'theme_slug=/etc/'
  condition: selection_plugin and selection_traversal
fields:
  - c-ip
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrative exports referencing nested theme paths
level: medium

YARA Rule

rule CVE_2026_110268_PEIMW_Traversal
{
    meta:
        description = "Detects Post Export Import with Media plugin traversal exploitation attempts in HTTP logs"
        cve = "CVE-2026-110268"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110268"
    strings:
        $p1 = "theme_slug=" nocase
        $t1 = "theme_slug=../" nocase
        $t2 = "theme_slug=..%2f" nocase
        $t3 = "theme_slug=%2e%2e%2f" nocase
        $t4 = "theme_slug=..%5c" nocase
        $feat = "peiwm_enable_admin_download_buttons" nocase
    condition:
        $p1 and any of ($t*) or ($feat and any of ($t*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110268 WordPress PEIMW theme_slug Directory Traversal"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"theme_slug="; nocase; pcre:"/theme_slug=(\.\.\/|%2e%2e%2f|%2e%2e\/|\.\.%2f|\.\.%5c)/i"; reference:cve,2026-110268; classtype:attempted-recon; sid:2026110268; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where url.query : "theme_slug=*"]
  [network where url.query : ("*theme_slug=../*" or "*theme_slug=..%2f*" or "*theme_slug=%2e%2e%2f*" or "*theme_slug=..%5c*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uq=lower(urldecode(uri_query))
| where like(uq,"%theme_slug=%") AND (match(uq,"theme_slug=(\.\./)+") OR match(uq,"theme_slug=%2e%2e%2f") OR match(uq,"theme_slug=\.\.%5c"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, useragent
| sort -count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-110268,">
  <rule id="2026110268" level="10">
    <if_sid>31100</if_sid>
    <url type="pcre2">(?i)theme_slug=(\.\./|%2e%2e%2f|\.\.%2f|\.\.%5c)</url>
    <description>CVE-2026-110268: PEIMW plugin theme_slug directory traversal attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — a single source indicates a fix but no confirmed patched version string or vendor advisory is available; treat patch status as unverified.

1. Immediate mitigations. Disable the peiwm_enable_admin_download_buttons plugin setting — the NVD description states exploitation requires this feature to be enabled, so turning it off removes reachability. Restrict administrator-account issuance and audit admin logins. If the plugin is not actively needed, deactivate and remove it.
2. Patch/upgrade steps. Confirm with the plugin maintainer the first version containing the fix (no confirmed patched version is published). Once verified, upgrade beyond 1.17.2. Because the fix is CLAIMED by a single source, validate the change post-upgrade (verify traversal input is rejected) rather than assuming remediation.
3. Long-term hardening. Enforce least-privilege on WordPress admin roles and monitor for privilege sprawl; deploy WAF rules matching traversal sequences on theme_slug; apply input canonicalization and ../ filtering expectations in vendor review; monitor web logs for encoded traversal before the sink.

References

• NVD — CVE-2026-110268: https://nvd.nist.gov/vuln/detail/CVE-2026-110268
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• WordPress Plugin Directory — Post Export Import with Media: https://wordpress.org/plugins/post-export-import-with-media/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored): https://www.first.org/epss

No threat actor campaigns, exploit-in-the-wild evidence, or public PoC are associated with CVE-2026-110268 at the time of writing.