CVE-2015-20124 HIGH

CVE-2015-20124: Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php

Vendor Aspose

Product Aspose Importer & Exporter

Weakness CWE-22 · Path traversal

Published October 20, 2026

Last update October 21, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

Key dates

02Disclosure timeline

October 20, 2026 CVE published

October 21, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2015-20124 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities

04Related CVE

CVE-2026-65431 Joomla Extension - regularlabs.com - Zipslip in GeoIP extension CVE-2026-19091 GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision CVE-2026-16078 WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability CVE-2026-13347 Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter