CVE-2014-5465 Download Shortcode <= 0.2.3 - Directory Traversal
MediumCVSS 5.0
EPSS 13.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| werdswords download shortcode | <= 0.2.3 | No fix listed |
| werdswords download shortcode | = 0.1 | No fix listed |
| werdswords download shortcode | = 0.2 | No fix listed |
| werdswords download shortcode | = 0.2.2 | No fix listed |
| wordpress download-shortcode(WordPress) | < 1.0 | 1.0 |
References
- packetstormsecurity.com exploit
- wordpress.org patch
- wordpress.org patch vendor-advisory
- wordpress.org patch
- 34436 exploit
- 69440 exploit vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org