CVE-2012-20002
TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php
James Charlesworth TinyMCE Thumbnail Gallery
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 34% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.1.0TinyMCE Thumbnail GalleryCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Text from CVE List
Affected versions 1
- TinyMCE Thumbnail Galleryaffected: 0.10 before 1.1.0CVE List
References 6
- wpscan.com/vulnerability/4a49b023-c1c9-4cc4-a2fd-af5f911bb400Advisoryvia CVE List
- vulncheck.com/advisories/tinymce-thumbnail-gallery-wordpress-plugin-1.1.0-path-traversal-via-download-image-phpAdvisoryvia CVE List
- packetstorm.news/files/id/113417/Exploitvia CVE List
- exploit-db.com/exploits/19022Exploitvia CVE List
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-tinymce-lfi.yamlReferencevia CVE List
- wordpress.org/plugins/tinymce-thumbnail-gallery/Referencevia CVE List