Description
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.
References
- https://plugins.trac.wordpress.org/changeset/582232
- [oss-security] 20140728 Re: CVE request: WordPress plugin vitamin traversal arbitrary file access mailing-list
- http://wordpress.org/plugins/vitamin/changelog/
- [oss-security] 20140724 CVE request: WordPress plugin vitamin traversal arbitrary file access mailing-list
- 54856 vdb-entry