Key points
- The flaw allows unauthenticated file downloads via an unsanitized parameter.
- Attackers can read database credentials by targeting wp-config.php.
- No patch is confirmed for versions prior to 3.0 in this report.
The Aspose Importer & Exporter plugin for WordPress contains a high-severity path traversal vulnerability in all versions before 3.0. This flaw allows unauthenticated attackers to download arbitrary files from the server. The issue stems from an unsanitized 'file' parameter that fails to restrict access to safe directories.
In plain English
The plugin permits users to request specific files for download without proper verification. Attackers can manipulate the request to include directory traversal sequences, such as moving up multiple folder levels. This technique enables them to read sensitive system files that should remain hidden from external access.
The background
The National Vulnerability Database rates the issue as CVSS 8.7 HIGH, classifying it under CWE-22. Shadowserver Foundation first observed exploitation attempts on October 20, 2023. These attacks targeted the aspose_import_export_download.php script using paths like ../../../wp-config.php to extract database credentials.
What changes now
Site administrators using versions prior to 3.0 face immediate risk of credential theft. The vulnerability requires no authentication, making it accessible to anyone scanning the internet. While earlier reports from Vuln Post covered other plugin flaws, this specific path traversal issue remains a critical exposure for outdated installations.
Who needs to act first
Teams should immediately identify all WordPress sites running the affected plugin versions. Prioritize systems exposed to the public internet, as they face the highest risk of automated scanning. Verify current plugin versions across all environments before attempting any changes. If an update is available, test it in a staging environment first. Back up site configurations and databases to ensure recovery options exist if the update causes compatibility issues.
What to do and how to stay safe: Aspose
- Audit all WordPress installations to locate instances of the Aspose Importer plugin below version 3.0.
- Restrict access to the vulnerable PHP script via web server rules or firewalls if immediate removal is not possible.
- Monitor server logs for unusual GET requests containing directory traversal sequences or references to configuration files.
- Prepare to upgrade to the latest stable version once the vendor confirms a secure release is available.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of the Aspose plugin are affected?
All versions of the Aspose Importer & Exporter plugin for WordPress before 3.0 are vulnerable to this path traversal flaw.
Can attackers exploit this without logging in?
Yes, the vulnerability allows unauthenticated attackers to download arbitrary files by sending specific GET requests to the plugin.
What specific files are at risk?
Attackers can target sensitive files such as wp-config.php to read database credentials and other configuration details.
