CVE-2026-77193: eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter
The eesyID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wppath parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it; no WordPress account, privileges, or user interaction are required.
Which installations are affected?
All versions of the eesy_ID2WP – Publish InDesign HTML5 WordPress plugin through 1.0.3, including 1.0.3, are affected.
What could an attacker obtain?
An attacker may read arbitrary files accessible to the web server. Those files can contain sensitive information.
How can I determine whether my site is exposed?
Check whether the eesy_ID2WP – Publish InDesign HTML5 plugin is installed and whether its version is 1.0.3 or earlier. An installed affected version should be treated as exposed because exploitation is unauthenticated.