CVE-2016-20103: Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cherry Plugin for WordPressto a version that resolves this vulnerability.Fixed in 1.2.7
Event History
Frequently Asked Questions
What level of access does an attacker need?
No authentication or prior privileges are required. An attacker can send a GET request to the affected download endpoint and control the file parameter.
What information could be exposed?
An attacker can download arbitrary files readable by the web server. This can include wp-config.php, which may disclose database credentials.
How can I check for attempted exploitation?
Review web-server access logs for requests to /admin/import-export/download-content.php, especially requests whose file parameter contains traversal sequences such as ../ or references wp-config.php.
Is exploitation known to have occurred in the wild?
Yes. The Shadowserver Foundation first observed exploitation evidence on 2023-10-19.