VulnerabilityModified

CVE-2015-5065

Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl…

MEDIUM 5.0EPSS 16.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 16.3%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS: 16.32% probability · 97th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: intelligent-it/paypal currency converter basic for woocommerce
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/75416Third Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerceThird Party Advisory
https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/Patch, Third Party Advisory
https://www.exploit-db.com/exploits/37253/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/75416Third Party Advisory, VDB Entry
https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerceThird Party Advisory
https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/Patch, Third Party Advisory
https://www.exploit-db.com/exploits/37253/Exploit, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.