CVE-2015-5482

NONE EPSS 75.9%
Published Aug 18, 201510y ago · Modified Jun 17, 20262w ago
Find Similar
Published Aug 18, 2015 10y ago
Last Modified Jun 17, 2026 2w ago

Description

Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.

Threat Intelligence

EPSS Exploit Probability
75.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
dev4pressgd_bbpress_attachments* ≤2.2

References 4

  • packetstormsecurity.com https://packetstormsecurity.com/files/132656/wpgdbbpress-lfi.txt
    Exploit
  • security.dxw.com https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/
    Exploit
  • wordpress.org https://wordpress.org/plugins/gd-bbpress-attachments/changelog/
    Patch
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/8087

Remediation

  • wordpress.org https://wordpress.org/plugins/gd-bbpress-attachments/changelog/
    Patch