Live › vulnerability › CVE-2017-20287
Go to dashboardThe Javo Spot theme for WordPress before 3.0.0 lets anyone without an account read arbitrary files through the fn parameter of its jvfrm_spot_get_json AJAX action. An attacker can request wp-config.php to obtain database credentials and secret keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Javo Spot theme version in the WordPress admin under Appearance > Themes, or inspect the theme's style.css header.
Update the Javo Spot theme to version 3.0.0 or later; rotate database credentials and WordPress secret keys if the site was exposed.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2017-20287")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.