CVE-2015-20124: Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to asposeimportexportdownload.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote, unauthenticated attacker can exploit it if they can reach the vulnerable plugin download script over the network. No WordPress account or user interaction is required.
What does an attacker need to send to exploit it?
The attacker needs to make a GET request to aspose_import_export_download.php and control its file parameter. Traversal sequences can be used to request files outside the intended directory, including ../../../wp-config.php.
What information could be exposed?
The vulnerability permits arbitrary file downloads from the affected WordPress host. The provided example targets wp-config.php, which can expose database credentials.
Which installations are affected?
Aspose Importer & Exporter WordPress Plugin versions before 3.0 are affected. The data does not identify any configuration requirement, so installations exposing the vulnerable script should be treated as potentially affected.
How can defenders look for exploitation attempts?
Review web-server and application request logs for GET requests to aspose_import_export_download.php, especially requests whose file parameter contains traversal sequences such as ../ or targets sensitive files such as wp-config.php. Exploitation evidence was observed by the Shadowserver Foundation on 2023-10-20.