CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the download_file_ajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
The Ultimate WordPress Toolkit plugin contains a path traversal vulnerability that allows authenticated users with low privileges to read, modify, or delete arbitrary files on the server. An attacker can navigate outside intended directories using specially crafted file paths. This affects all versions up to 3.0.8. Site administrators should update immediately to a patched version.
What an attacker can do
Read, modify, or delete arbitrary files on the server.
Potential impact on your site
Attackers with basic user accounts can access sensitive files, corrupt site data, or disable the site entirely.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
