Path Traversal Vulnerability in Aspose PDF Exporter Plugin for WordPress
CVE-2015-20125

8.7HIGH

Key Information:

Vendor: WordPress
Status: Aspose PDF Exporter
Vendor: CVE Published:; 20 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2015-20125?

The Aspose PDF Exporter plugin for WordPress prior to version 2.0 is susceptible to a path traversal vulnerability. This flaw allows unauthorized attackers to exploit unsanitized input from the 'file' parameter in readfile(). By crafting GET requests to the aspose_pdf_exporter_download.php script, an attacker can manipulate the path and access sensitive files, including the WordPress database configuration file (wp-config.php). This level of unauthorized access could lead to the exposure of critical data such as database credentials. The first evidence of exploitation was documented on October 19, 2023.

Affected Version(s)

Aspose PDF Exporter 1.0 < 2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2015-20125 - Proof of Concept