{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acherry_plugin_projectcherry_pluginwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cherry_plugin_project:cherry_plugin:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2016-20103"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cherry Plugin (\u003c 1.2.7)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","wordpress","path-traversal"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eCherry Plugin for WordPress, prior to version 1.2.7, contains a path traversal vulnerability that exposes sensitive server files to unauthenticated remote attackers. The vulnerability resides within the \u003ccode\u003edownload-content.php\u003c/code\u003e script located in the plugin's administration directory. The script fails to properly sanitize the \u003ccode\u003efile\u003c/code\u003e parameter before passing it to the PHP \u003ccode\u003ereadfile()\u003c/code\u003e function.\u003c/p\u003e\n\u003cp\u003eThis flaw allows attackers to traverse the directory structure using sequences like \u003ccode\u003e../\u003c/code\u003e to access files outside the intended web root, such as \u003ccode\u003ewp-config.php\u003c/code\u003e. Successful exploitation results in the unauthorized disclosure of database credentials and other sensitive configuration details stored in the WordPress environment. This vulnerability has been subject to in-the-wild exploitation, with evidence documented as early as October 2023. Organizations using this plugin are advised to upgrade to version 1.2.7 or later to mitigate the risk of credential theft and subsequent unauthorized access to the underlying database.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify WordPress sites running vulnerable versions of Cherry Plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request targeting the path \u003ccode\u003e/admin/import-export/download-content.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker appends the \u003ccode\u003efile\u003c/code\u003e query parameter with path traversal sequences, such as \u003ccode\u003efile=../../../../../wp-config.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe web server processes the request and passes the tainted parameter directly to \u003ccode\u003ereadfile()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ereadfile()\u003c/code\u003e function executes, breaking out of the plugin directory and accessing the targeted system file.\u003c/li\u003e\n\u003cli\u003eThe web server returns the contents of the requested sensitive file to the attacker's HTTP response stream.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response for database credentials (e.g., DB_PASSWORD) or other configuration artifacts.\u003c/li\u003e\n\u003cli\u003eAttacker uses the harvested credentials to gain unauthorized access to the application database.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read any file readable by the web server user. This leads to the compromise of critical configuration files like \u003ccode\u003ewp-config.php\u003c/code\u003e, which contain database credentials, secret keys, and salt values. Exposure of this information can lead to complete database takeover, modification of site content, and potential further exploitation of the server environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Cherry Plugin for WordPress to version 1.2.7 or later immediately to patch the insecure file handling logic.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect attempts to access sensitive files via the known vulnerable endpoint.\u003c/li\u003e\n\u003cli\u003eAudit database logs and application credentials if unauthorized access is suspected, as this vulnerability facilitates credential harvesting.\u003c/li\u003e\n\u003cli\u003eEnable web application firewall (WAF) rules to block HTTP requests containing path traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e) directed toward the \u003ccode\u003edownload-content.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:57Z","date_published":"2026-10-20T21:53:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cherry-plugin-path-traversal/","summary":"Cherry Plugin for WordPress versions before 1.2.7 contain a path traversal vulnerability in the import-export module that allows unauthenticated attackers to read arbitrary files from the web server.","title":"Cherry Plugin for WordPress: Path Traversal Vulnerability (CVE-2016-20103)","url":"https://feed.craftedsignal.io/briefs/2026-10-cherry-plugin-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:cherry_plugin_project:cherry_plugin:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}