Directory Traversal Vulnerability in Elegant Themes Divi Theme for WordPress
CVE-2015-1579

Currently unrated

Key Information:

Vendor
Wordpress
Status
Divi
Vendor
CVE Published:
11 February 2015

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 56%

Summary

The Elegant Themes Divi theme for WordPress is susceptible to a directory traversal vulnerability, enabling remote attackers to access arbitrary files on the server. This is facilitated through manipulating the 'img' parameter within the 'revslider_show_image' action in wp-admin/admin-ajax.php, allowing unauthorized file reads by using a sequence of dot-dot-slash (..) in the request. This vulnerability poses a significant risk as it may expose sensitive server files, compromising the integrity and confidentiality of the hosted applications.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

WordPressMassExploiter
Created by paralelo14

CVE-2015-1579
Created by paralelo14

References

https://wpvulndb.com/vulnerabilities/7540
x_refsource_MISC
http://www.exploit-db.com/exploits/36039
exploitx_refsource_EXPLOIT-DB

EPSS Score

56% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.