Description
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| James Charlesworth | TinyMCE Thumbnail Gallery | 0.10 – < 1.1.0 | 1.1.0 |
References
- Packet Storm 113417 exploit
- EDB-19022 exploit
- WPScan Advisory third-party-advisory
- Nuclei Template technical-description
- WordPress Download Page product
- VulnCheck Advisory: TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php third-party-advisory