CVE-2012-20002: TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TinyMCE Thumbnail Gallery WordPress Pluginto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the plugin's download-image.php endpoint can attempt exploitation. No credentials or user interaction are required.
What request pattern indicates exploitation attempts?
Look for GET requests to /php/download-image.php where the href parameter contains directory-traversal sequences such as ../../../../. Requests targeting wp-config.php are particularly significant because that file can contain database credentials.
Are installations using the default plugin configuration affected?
The available data identifies affected versions as those before 1.1.0 and does not describe any configuration prerequisite. The vulnerable endpoint is reachable through the plugin path stated in the advisory.
What information could an attacker obtain?
An attacker may read arbitrary files accessible to the web server process. The described examples include wp-config.php, database credentials, and system files.
Has this vulnerability been observed being exploited?
Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.