VulnerabilityModified
CVE-2015-5482
Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a ..
MEDIUM 4.0EPSS 1.81%
Does this matter?
Lower severity and a low EPSS score (1.81%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
- EPSS
- 1.81% probability · 77th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- dev4press/gd bbpress attachments
- Source
- cve@mitre.org
References
- https://packetstormsecurity.com/files/132656/wpgdbbpress-lfi.txtExploit
- https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/Exploit
- https://wordpress.org/plugins/gd-bbpress-attachments/changelog/Patch
- https://wpvulndb.com/vulnerabilities/8087
- https://packetstormsecurity.com/files/132656/wpgdbbpress-lfi.txtExploit
- https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/Exploit
- https://wordpress.org/plugins/gd-bbpress-attachments/changelog/Patch
- https://wpvulndb.com/vulnerabilities/8087
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.