The plugin contains a directory traversal flaw that is triggered when the 'theme_slug' parameter is supplied during an export or import operation. An authenticated attacker with administrative privileges can manipulate the value of this parameter to access files located outside the intended directory. Because the flaw is rooted in insufficient sanitization of the input, the attacker may read sensitive files or inject files into protected locations, potentially altering site functionality or compromising data integrity.

The vulnerability affects the WordPress plugin 'Post Export Import with Media' released by wpazleen. All versions up to and including 1.17.2 are susceptible. Users running 1.17.1 or 1.17.2 with the peiwm_enable_admin_download_buttons option turned on are at risk.

The CVSS score of 4.9 indicates a moderate severity. Exploitation requires that the admin download buttons feature be enabled and that the attacker already possess administrator-level credentials, limiting the attack surface. The absence of an EPSS score and the fact that this issue is not listed in CISA's KEV catalog suggest that current exploitation activity is low. Nevertheless, the ability to access hidden files can lead to privilege escalation or data leakage if an attacker leverages it in conjunction with other vulnerabilities.