SiteRespond
Scan

Threat intelligence

Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import

CVE-2026-13430 · post-export-import-with-media

Important: Seeing this vulnerability listed does not mean your website is affected. Exposure depends on whether you run Post Export Import With Media at a vulnerable version. How SiteRespond intelligence works

Vulnerability
Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import
Affected software
post-export-import-with-media(Plugin)
Affected versions
  • ≤ 1.13.1
Authentication
Authenticated (see advisory title)
Vulnerability type
Remote code execution
CVE
CVE-2026-13430
Published
9 July 2026
CISA KEV
Not listed in CISA KEV at last catalog refresh
Impact
May allow attackers to run arbitrary code on the server if exploited.
Source

Data imported from Wordfence Intelligence (advisory 42f94f80-6157-4778-ad69-184943134fd2). Methodology and redistribution notes

Check whether your installed version is affected

SiteRespond Defence matches your installed Post Export Import With Media version against this catalog when the Defence plugin is connected to your WordPress site.

Start SiteRespond Defence for WordPress — £29.99/monthScan your website
All Post Export Import With Media advisoriesBack to catalog