Javo Spot: Path traversal in WordPress theme (CVE-2017-20287)

The Javo Spot WordPress theme (versions prior to 3.0.0) contains a path traversal vulnerability in the jvfrm_spot_get_json AJAX action. An unauthenticated attacker can exploit this flaw by sending a crafted GET request to wp-admin/admin-ajax.php, manipulating the fn parameter to access arbitrary files on the web server. This vulnerability has been exploited in the wild, with activity reported by the Shadowserver Foundation as early as 2023-10-19. Successful exploitation may lead to the disclosure of sensitive configuration files, including wp-config.php, which contains database credentials and authentication secret keys.

Impact

Exploitation permits unauthorized reading of arbitrary server-side files. Exposure of wp-config.php provides attackers with database access and cryptographic secrets, which can lead to further compromise of the WordPress installation, remote code execution via database modification, or session hijacking.

Recommendation

• Identify all WordPress instances utilizing the Javo Spot theme.
• Upgrade the Javo Spot theme to version 3.0.0 or higher immediately.
• If an immediate upgrade is not possible, disable the jvfrm_spot_get_json AJAX action or apply a Web Application Firewall (WAF) rule to filter fn parameters containing directory traversal sequences (e.g., ../).
• Audit the wp-config.php file and database credentials for signs of unauthorized access or modification if the site was running a vulnerable version while internet-facing.