Description
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Published: 2026-10-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

This vulnerability is a classic path traversal flaw that lets an unauthenticated attacker request arbitrary files from the server via the unsanitized 'file' parameter in aspose_pdf_exporter_download.php. By sending traversal sequences such as ../../../wp-config.php, an attacker can download WordPress configuration files, exposing database credentials and other sensitive data. The flaw is classified as CWE-22 and has a CVSS score of 8.7, indicating high severity.

Affected Systems

The affected product is the Aspose PDF Exporter WordPress plugin for versions prior to 2.0. Any WordPress installation that has not upgraded to version 2.0 or later is potentially vulnerable.

Risk and Exploitability

The attack requires no authentication and relies solely on the ability to send crafted GET requests to the plugin's download endpoint. Because the 'file' parameter is used directly in readfile(), there is no input validation or path sanitization, allowing straightforward exploitation. The EPSS score is not available and the vulnerability has not been listed in the CISA KEV catalog, but the high CVSS score and the ease of exploitation make it a significant risk for exposed WordPress sites.

Generated by OpenCVE AI on October 20, 2026 at 21:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Aspose PDF Exporter plugin to version 2.0 or newer, eliminating the path traversal flaw.
  • If an upgrade is not immediately possible, block or restrict access to aspose_pdf_exporter_download.php using server‑side rules such as .htaccess, firewall rules, or by requiring authentication.
  • Review the site’s web application firewall to detect or block path traversal request patterns, and monitor logs for unusual access attempts to plugin files.

Generated by OpenCVE AI on October 20, 2026 at 21:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Title Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-28T16:36:16.046Z

Reserved: 2026-10-14T20:25:24.125Z

Link: CVE-2015-20125

cve-icon Vulnrichment

Updated: 2026-10-28T16:36:10.249Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T21:17:13.210

Modified: 2026-10-28T17:17:19.297

Link: CVE-2015-20125

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T21:45:14Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')