CVE-2015-4694 Zip Attachments <= 1.5 - Directory Traversal
HighCVSS 8.6
EPSS 15.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zip attachments project zip attachments | <= 1.5 | No fix listed |
| wordpress zip-attachments(WordPress) | < 1.5.1 | 1.5.1 |
References
- [oss-security] 20150612 zip-attachments v1.1.4 wordpress plugin arbitrary file download vulnerability. exploit mailing-list
- [oss-security] 20150612 Re: zip-attachments v1.1.4 wordpress plugin arbitrary file download vulnerability. exploit mailing-list
- 75211 vdb-entry
- www.vapid.dhs.org exploit
- wordpress.org patch vendor-advisory
- wordpress.org
- wpvulndb.com
- Wordfence Intelligence third-party-advisory
- www.cve.org