Directory Traversal Vulnerability in Download Zip Attachments Plugin for WordPress
CVE-2015-4704

7.5HIGH

Key Information:

Vendor
Wordpress
Status
Download Zip Attachments
Vendor
CVE Published:
23 May 2017

Summary

The Download Zip Attachments plugin version 1.0 for WordPress is vulnerable to directory traversal attacks, allowing remote attackers to exploit the weakness through manipulated file parameters in download.php. By including a '..' (dot dot) sequence in the File parameter, attackers can gain access to arbitrary files on the server, posing significant security risks to systems using this plugin.

References

http://packetstormsecurity.com/files/132459/Download-Zip-...
x_refsource_MISC
http://www.vapid.dhs.org/advisory.php?v=129
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.