Live › vulnerability › CVE-2015-20124
Go to dashboardThe Aspose Importer & Exporter WordPress plugin before 3.0 lets anyone download arbitrary files through the unsanitized file parameter in aspose_import_export_download.php. An attacker can read wp-config.php and obtain database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether the plugin folder for Aspose Importer & Exporter exists and read its version; a file named aspose_import_export_download.php under wp-content/plugins should be present on affected installs.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
This page as .md · .json · in your agent: get_signal("CVE-2015-20124")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.