Live › vulnerability › CVE-2015-20125
Go to dashboardThe Aspose PDF Exporter WordPress plugin before 2.0 passes an unsanitized 'file' parameter to readfile(). An unauthenticated attacker can request aspose_pdf_exporter_download.php with ../ sequences to download files such as wp-config.php, exposing database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2015-20125")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.