The Post Export Import with Media plugin for WordPress is vulnerable to arbitrary file uploads due to a trailing‑dot filename bypass. An attacker with administrator or higher privileges can upload a file such as shell.php. that passes the allow‑list check because the pathinfo() call returns an empty extension. The file is then extracted and copied into the uploads directory without re‑validation, enabling execution of malicious code.

All installations of the Post Export Import with Media plugin for WordPress, versions up to and including 1.13.1, are affected. The vulnerability exists in the import_media_file_secure functionality accessed via the ajax_import_media_start() routine.

The CVSS score is 7.2, and the EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires authenticated access with administrator‑level permissions to execute code, compromising the integrity and availability of the site. No public exploits are documented, but the path to attack is well understood.