Directory Traversal Vulnerability in XCloner Plugin for WordPress

CVE-2014-8606

Summary

The XCloner plugin for WordPress has a directory traversal vulnerability that allows unauthorized remote administrators to access arbitrary files. This is achieved by manipulating the file parameter in the json_return action on the xcloner_show page, specifically targeting wp-admin/admin-ajax.php. By exploiting this vulnerability, attackers may gain access to sensitive system files, potentially leading to further exploitation of the hosting environment. It is crucial for users of the affected plugin versions to implement protective measures and ensure their installations are up to date to mitigate any risks.

References