CVE-2012-20002TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php

Description

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• Packet Storm 113417 exploit
• EDB-19022 exploit
• WPScan Advisory third-party-advisory
• Nuclei Template technical-description
• WordPress Download Page product
• VulnCheck Advisory: TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php third-party-advisory