Directory Traversal Vulnerability in zM Ajax Login & Register Plugin for WordPress
CVE-2015-4153

Currently unrated

Key Information:

Vendor

Wordpress
Status
Zm Ajax Login \& Register
Vendor
CVE Published:
10 June 2015

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 13%

What is CVE-2015-4153?

The zM Ajax Login & Register plugin for WordPress suffers from a directory traversal vulnerability that could allow an attacker to include and execute arbitrary PHP files remotely. This vulnerability arises when the plugin improperly handles user-supplied input in specific template parameters, specifically in the load_template action on wp-admin/admin-ajax.php. Exploitation of this flaw can lead to severe security implications, enabling unauthorized access and execution of malicious scripts on vulnerable WordPress installations.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2015-4153 - Proof of Concept

References

https://security.gentoo.org/glsa/201512-10
vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/37200/
exploitx_refsource_EXPLOIT-DB
https://wordpress.org/plugins/zm-ajax-login-register/chan...
x_refsource_CONFIRM

EPSS Score

13% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.