Post Export Import with Media
Post Export Import with Media has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 1 of the records (100%).
The one issue recorded for Post Export Import with Media has a vendor fix available, so running the current release closes it.
All of these findings were reported by Chloe Chamberland. Post Export Import with Media is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-13430Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import
Read the full analysisVulnerability Records

Post Export Import with Media
Author
wpazleen
Post Export Import with Media exports and imports posts, pages, media, users, widgets, menus, themes, plugins, and settings between WordPress sites, with every image and attachment carried across intact. The default WordPress exporter leaves image files behind and only writes a reference to them; this plugin downloads and reattaches the actual files, metadata, so imported content never ends up with broken data, links or missing thumbnails. Whether you’re moving to a new host, creating staging sites, or backing up your content, this plugin handles everything with professional-grade reliability, user-friendly interface and powerful built-in Batch Processing for high-performance transfers all designed for simplicity and control. ✨ Key Features Export and import posts with all attached media files, metadata, categories, tags, and custom fields Automatic media file detection and download during import Real-time progress tracking for smooth migration Smart image handling – reuses existing media, downloads missing files Support for featured images and inline content images Enable WPML multilingual language support Smart Image Matching Strategy: Verify only fallback matches (fastest) Verify all matches (prevents duplicate filename mismatches) Always download fresh images Link reused media to imported posts by updating the Uploaded to relationship Selective Export & Import Export specific posts or pages instead of entire content Export content by date range Filter posts using custom From and To dates before export Preview and choose content before importing Set status before import (Public, Private, Draft) Bulk delete functionality with confirmation dialogs CPT & ACF Export/Import Export Custom Post Types with all associated posts Includes ACF fields, taxonomies, and media Built-in support for exporting and importing custom ACF meta fields Secure data handling to prevent errors or data loss Lightweight and beginner-friendly interface Works for bloggers, developers, and site administrators Batch Processing Settings (Optimized for large-scale websites) Scheduled Exports (Automated Backups) Users Export/Import Smart author mapping (match by username or email instead of ID) Assign posts to current admin user Automatically create missing users Export user data (login, email, display name, roles, etc.) Includes hashed passwords for instant login after import Supports user meta, capabilities, and plugin role data WooCommerce user data (billing, shipping, last active) ACF user fields support CPT authorship mapping for accurate reassignment Import options: Set default password for all imported users Send welcome email with login credentials (if email is configured) Try to preserve original user IDs (conflicts logged) Media & Image Handling Automatic media detection and download during import Smart Image Matching Strategy: Verify only fallback matches (fastest) Verify all matches (verifies file size to prevent duplicate filename mismatches) Always download fresh images from the source Reuse existing media when possible Link reused media to imported posts by updating the Uploaded to relationship Full support for featured images and inline content images Pages Export/Import Complete page hierarchy preservation Template assignments and page metadata Featured images and content images handling Parent-child page relationships maintained Supports selective export/import for pages Custom page attributes and settings CPT & ACF Export/Import Export Custom Post Types with all associated posts Full ACF (Advanced Custom Fields) support including field groups and values Export and import custom ACF meta fields seamlessly Includes associated taxonomies and terms Media files linked to CPT content are fully handled Maintains relationships between posts, fields, and taxonomies Supports selective export/import for specific CPTs Users Export/Import Export core user data (login, email, display name, roles, registration info) Preserve access with hashed passwords on import Handle user meta, capabilities, and plugin-defined role data Includes WooCommerce customer details (billing, shipping, activity) Supports ACF fields attached to user profiles Maintains authorship mapping across Custom Post Types Auto-create users when missing during import Flexible import controls: Map authors by username or email Assign content to current admin if needed Set a global password for imported users Optionally send welcome emails (if configured) Attempt to retain original user IDs (logs conflicts) WordPress Settings Backup 7 settings categories: General, Writing, Reading, Discussion, Media, Permalinks, Privacy Site icon export/import with URL information Selective import – choose which settings to import Detailed import logs showing success/failure for each setting Handles deprecated WordPress options automatically Widgets & Navigation Menus Complete widget configuration export/import Widget positions and sidebar assignments Navigation menu structure with all items Menu locations and theme assignments Menu item hierarchy and custom properties Support for all widget types including custom HTML, media widgets Themes & Plugins Backup Export active theme, all themes, or selected themes Export active plugins, all plugins, or selected plugins ZIP file creation with proper directory structure Import with replace existing or keep both options Automatic theme/plugin activation after import Advanced Admin Features Admin Download Buttons – Add download buttons to WordPress themes.php and plugins.php pages Media Statistics – Comprehensive media library analysis with file types, sizes, and usage System Configuration Test – Check server capabilities and requirements Plugin Recommendations – Curated list of useful WordPress plugins 🎯 Perfect For Web Developers – Quickly clone sites for development and testing Site Migrations – Move WordPress sites between hosts seamlessly Backup Solutions – Create complete site backups including media Staging Sites – Duplicate production sites for safe testing Client Handoffs – Package complete sites for client delivery Multi-site Management – Sync content between multiple WordPress installations 🔧 Technical Excellence Security First – All operations use WordPress nonces and capability checks Memory Efficient – Handles large sites without memory issues Cross-Platform – Works on Windows, Linux, and macOS servers Error Recovery – Comprehensive error handling and user feedback Progress Tracking – Real-time updates during long operations Clean Code – Well-documented, maintainable codebase following WordPress standards 📊 Real-time Progress & Logging Every operation provides detailed feedback: * Progress bars showing completion percentage * Timestamped logs with success/warning/error indicators * Detailed statistics (items imported, skipped, failed) * Clear error messages with actionable solutions * Import/export summaries with file information 🎨 User Experience Intuitive Interface – Clean, modern admin interface Responsive Design – Works perfectly on desktop and mobile Modal Confirmations – Safe operations with confirmation dialogs Detailed Help – Comprehensive descriptions and usage instructions Professional Styling – Matches WordPress admin design language External Services This plugin connects to a small number of external services, only when the related feature is actually used. Freemius Checkout Loads the Freemius checkout script when a user opens the Pro upgrade modal in the WordPress admin. The script is served from checkout.freemius.com. No personal data or form submission data is sent. Terms: https://freemius.com/terms/ | Privacy: https://freemius.com/privacy/ Media import from external URLs When importing content that references images hosted on another domain (for example, a localhost or staging URL from the source site), the plugin downloads those specific image files directly from that URL so they can be attached to the imported post. This only happens for media URLs found inside the import file you provide, not as a background or scheduled connection. WordPress.org Plugin Directory API The Plugin Recommendations screen calls the official WordPress.org plugins_api (api.wordpress.org) to pull live names, descriptions, and icons for a short list some recommended WordPress plugins. This only runs when you open the Recommendations screen, the results are cached locally for 10 days to avoid repeat requests, and no data about your site or its content is sent. Terms: https://wordpress.org/about/privacy/ Source Code The source files for all compiled/minified JavaScript and CSS in this plugin are publicly available at: https://github.com/wpazleen/post-export-import-with-media Build instructions: Clone the repository. Run npm install in the root to install dependencies. Run npm run build to compile the JavaScript and CSS. Compiled output is written to /build/js/ and /build/css/, matching what ships in the plugin. Competitor Analysis Search the WordPress plugin directory for a way to export WordPress posts with their media, and the results split into two groups: large general-purpose export tools built for spreadsheets, and small single-purpose add-ons built to patch one gap in the native exporter. Post Export Import with Media sits in a third position: a dedicated export and import tool built around content plus media plus the rest of the site. WP All Export is the closest thing to a household name in this space support for exporting almost any post type or custom field into CSV, XML, or Excel. Its own FAQ is direct about the trade-off: you export one post type at a time, there is no way to export a full site in a single pass, and to get WordPress media specifically you export the post type that the images are attached to rather than treating media as its own export target. Post Export Import with Media treats media as the primary concern rather than a side effect, with automatic detection of featured and inline images, three image-matching strategies, and reuse of existing Media Library files. Where WP All Export pulls ahead is field-level flexibility, letting you rename and reorder every CSV or XML column by hand, which is a real advantage for anyone building a custom data feed rather than migrating a site. Export media with selected content, by DKZR, is a small, well-loved plugin that solves one specific problem: the native WordPress export screen leaves attachments out by default, and this plugin adds a checkbox to include them. It is a genuinely useful patch for the built-in exporter, but it stops there; there is no image-matching logic, no rewriting of image URLs for a new domain, and no support for users, widgets, menus, themes, plugins, or settings. Post Export Import with Media replaces the native exporter entirely rather than patching it, and covers the rest of a site migration or backup in the same place. Product Import Export for WooCommerce and Order Export & Order Import for WooCommerce, both are mature, widely installed tools built specifically around WooCommerce products, coupons, and orders moving in and out of CSV files, with the product plugin adding ChatGPT-generated descriptions for products missing one. Both are strong choices if WooCommerce commerce data is the whole job. Post Export Import with Media is not scoped to WooCommerce data types; it is built for general WordPress content, so it handles standard posts, pages, and CPTs alongside the WooCommerce user data (billing, shipping, activity) it picks up when exporting users, rather than orders or coupons themselves. So of everything that turns up in an “export WordPress posts with media” or “WordPress migration plugin” search, the gap Post Export Import with Media fills is the one in the middle: a plugin that treats content, media, users, widgets, menus, themes, plugins, and settings as one export and import job, with a progress bar and a preview step, rather than requiring a spreadsheet tool for content and a separate backup plugin for everything else.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C