{"id":"CVE-2015-5065","url":"https://www.cyber-defence.io/tools/cve/CVE-2015-5065","generatedAt":"2026-11-05T06:12:45.449Z","title":"Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl…","description":"Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before 1.4 for WordPress allows remote attackers to read arbitrary files via a full pathname in the requrl parameter.","published":"2015-06-24T14:59:07.000Z","lastModified":"2026-06-17T00:28:23.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":5,"severity":"MEDIUM","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N"},"cwe":["CWE-22"],"affected":["intelligent-it/paypal currency converter basic for woocommerce"],"epss":{"score":0.16213,"percentile":0.96953,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2015-06-10","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":37253,"kind":"exploit","title":"WordPress Plugin Paypal Currency Converter Basic For WooCommerce - File Read","url":"https://www.exploit-db.com/exploits/37253","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/37253.txt","file":"exploits/php/webapps/37253.txt","published":"2015-06-10","added":"2015-06-10","updated":"2016-10-10","author":"Kuroi'SH","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2015-5065","OSVDB-123187"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.compaypal-currency-converter-basic-for-woocommerce.zip","screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 16.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/75416","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerce","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/37253/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/132278/WordPress-Paypal-Currency-Converter-Basic-For-Woocommerce-1.3-File-Read.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/75416","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://plugins.trac.wordpress.org/changeset/1179092/paypal-currency-converter-basic-for-woocommerce","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wordpress.org/plugins/paypal-currency-converter-basic-for-woocommerce/changelog/","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/37253/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-5065","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}