Live › vulnerability › CVE-2016-20103
Go to dashboardCherry Plugin for WordPress before 1.2.7 passes the 'file' parameter straight to readfile(), so anyone can request arbitrary server files with path traversal. An attacker can read wp-config.php and obtain database credentials without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
1.2.7 (for example, look in wp-content/plugins/ for a cherry directory and its plugin header)../1.2.7 or later, or remove the pluginEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2016-20103")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.