Unscored CVE-2015-5609 EUVD-2015-5562GHSA-7394-mpvp-x94f

Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary fil…

Published May 23, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Description

Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.

References

http://www.vapid.dhs.org/advisory.php?v=135
[oss-security] 20150720 Re: Remote file download vulnerability in Wordpress Plugin image-export v1.1 mailing-list
[oss-security] 20150713 Remote file download vulnerability in Wordpress Plugin image-export v1.1 mailing-list