CVE-2015-20125: Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to asposepdfexporterdownload.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Aspose PDF Exporter WordPress Pluginto a version that resolves this vulnerability.Fixed in 2.0
Event History
Frequently Asked Questions
Which plugin versions are affected?
Aspose PDF Exporter versions before 2.0 are affected.
Does exploitation require WordPress authentication or user interaction?
No. An unauthenticated attacker can exploit the issue by sending a GET request to the download script.
What information could an attacker obtain?
An attacker may retrieve files outside the intended path, including wp-config.php, which can expose WordPress database credentials.
Has exploitation been observed in the wild?
Yes. The Shadowserver Foundation first observed exploitation evidence on 2023-10-19.