CVE-2015-20125
Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
Aspose Aspose PDF Exporter
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 34% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.0Aspose PDF ExporterCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Text from CVE List
Affected versions 1
- Aspose PDF Exporteraffected: 1.0 before 2.0CVE List
References 6
- plugins.trac.wordpress.org/changeset/1127209/aspose-pdf-exporterFixvia CVE List
- wpscan.com/vulnerability/51dd0b6b-ba90-47e2-ad80-56b3e122bfd4Advisoryvia CVE List
- vulncheck.com/advisories/aspose-pdf-exporter-wordpress-plugin-2.0-path-traversal-via-aspose-pdf-exporter-download-phpAdvisoryvia CVE List
- packetstorm.news/files/id/131161/Exploitvia CVE List
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/aspose-pdf-file-download.yamlReferencevia CVE List
- wordpress.org/plugins/aspose-pdf-exporter/Referencevia CVE List