Vulnerability in Aspose PDF Exporter

[ Description ]Official description

Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/a…
• packetstorm.news/files/id/131161
• plugins.trac.wordpress.org/changeset/1127209/aspose-pdf-exporter
• wordpress.org/plugins/aspose-pdf-exporter
• wpscan.com/vulnerability/51dd0b6b-ba90-47e2-ad80-56b3e122bfd4
• www.vulncheck.com/advisories/aspose-pdf-exporter-wordpress-plugin-2.0-path-traversal-vi…