CVE-2015-20123: Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to asposedocexporterdownload.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Aspose Doc Exporter WordPress Pluginto a version that resolves this vulnerability.Fixed in 2.0
Event History
Frequently Asked Questions
Which installations should be treated as affected?
WordPress sites running Aspose Doc Exporter versions earlier than 2.0 should be treated as affected. The provided data does not identify any affected versions at or above 2.0.
Does exploitation require an authenticated WordPress user or other prior access?
No. The vulnerability can be exploited remotely through a GET request and requires no authentication or user interaction.
Has exploitation been observed in the wild?
Yes. The Shadowserver Foundation first observed exploitation evidence on 2023-10-23.