The Post Export Import with Media plugin for WordPress contains a flaw in its handling of the untrusted 'page_data[meta]' parameter that allows PHP Object Injection, classified as CWE-502. An attacker who can authenticate with administrator level or higher can supply a malicious payload that the plugin will deserialize without proper validation. This can introduce unexpected objects into the application’s memory space. If the application environment also contains a separate plugin or theme that provides a PHP Object Oriented Deserialization (POP) chain, the injected object could be leveraged to delete files, retrieve sensitive data, or execute arbitrary code. Absent such a chain, the vulnerability alone does not result in a security event.

All sites running the Post Export Import with Media plugin by wpazleen with a version of 1.17.1 or earlier are affected. The vulnerability applies to any WordPress installation that has one of these versions installed and activates its import/export functionality.

The CVSS score of 7.2 indicates high severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers require authenticated administrator or higher privileges to use the flaw, and the practical impact depends on the presence of an external POP chain. When such a chain exists, the risk can range from data loss to full remote code execution.