Unauthenticated Path Traversal in eesy_ID2WP WordPress Plugin

The eesy_ID2WP - Publish InDesign HTML5 plugin for WordPress is vulnerable to a path traversal vulnerability (CVE-2026-77193) affecting all versions up to and including 1.0.3. The vulnerability exists within the 'id2wp_path' parameter, which fails to properly sanitize user-provided input before using it to access files on the underlying server filesystem. An unauthenticated attacker can exploit this flaw by submitting crafted requests to the plugin to traverse directory structures, potentially reading sensitive configuration files, system files, or application source code. This vulnerability poses a significant risk to the confidentiality of the affected WordPress environment.

Impact

Successful exploitation allows unauthenticated attackers to read arbitrary files on the web server. Depending on server configuration and file permissions, this can lead to the exposure of sensitive data including database credentials, wp-config.php files, system environment variables, and site content.

Recommendation

• Update the eesy_ID2WP plugin to a version beyond 1.0.3 immediately.
• Implement Web Application Firewall (WAF) rules to inspect the 'id2wp_path' parameter for directory traversal sequences such as '../' or '..%2f'.
• Audit web server access logs for requests containing suspicious path traversal patterns targeting the plugin's endpoints.