CVE-2015-5609

Critical

Published: 23/05/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Image Export plugin version 1.1 for WordPress has an absolute path traversal vulnerability that allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.

Risk Assessment

This vulnerability could lead to unauthorized access to sensitive data and deletion of critical files, posing a serious threat to system security.

Recommendation

It is recommended to update the Image Export plugin to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.