CVE-2017-20287: Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrmspotgetjson AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Javo Spot WordPress Themeto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the WordPress site's /wp-admin/admin-ajax.php endpoint can attempt exploitation. No credentials or user interaction are required.
What information could be exposed?
An attacker can read arbitrary files through path traversal. The described request can retrieve wp-config.php, exposing database credentials and WordPress secret keys.
Which deployments are affected?
Javo Spot WordPress Theme versions before 3.0.0 are affected. The vulnerable AJAX action is reachable through the standard admin-ajax.php endpoint.
How can I check whether exploitation may have occurred?
Review web server and WordPress access logs for GET requests to /wp-admin/admin-ajax.php using the jvfrm_spot_get_json action and fn values containing traversal sequences such as ../../wp-config.php. Exploitation evidence was first observed on 2023-10-19.