This flaw allows attackers to traverse the directory structure using sequences like ../ to access files outside the intended web root, such as wp-config.php. Successful exploitation results in the unauthorized disclosure of database credentials and other sensitive configuration details stored in the WordPress environment. This vulnerability has been subject to in-the-wild exploitation, with evidence documented as early as October 2023. Organizations using this plugin are advised to upgrade to version 1.2.7 or later to mitigate the risk of credential theft and subsequent unauthorized access to the underlying database.

Attack Chain

1. Attacker performs reconnaissance to identify WordPress sites running vulnerable versions of Cherry Plugin.
2. Attacker crafts an HTTP GET request targeting the path /admin/import-export/download-content.php.
3. Attacker appends the file query parameter with path traversal sequences, such as file=../../../../../wp-config.php.
4. The web server processes the request and passes the tainted parameter directly to readfile().
5. The readfile() function executes, breaking out of the plugin directory and accessing the targeted system file.
6. The web server returns the contents of the requested sensitive file to the attacker's HTTP response stream.
7. Attacker parses the response for database credentials (e.g., DB_PASSWORD) or other configuration artifacts.
8. Attacker uses the harvested credentials to gain unauthorized access to the application database.

Impact

Successful exploitation allows unauthenticated attackers to read any file readable by the web server user. This leads to the compromise of critical configuration files like wp-config.php, which contain database credentials, secret keys, and salt values. Exposure of this information can lead to complete database takeover, modification of site content, and potential further exploitation of the server environment.

Recommendation

• Upgrade Cherry Plugin for WordPress to version 1.2.7 or later immediately to patch the insecure file handling logic.
• Deploy the provided Sigma rule to detect attempts to access sensitive files via the known vulnerable endpoint.
• Audit database logs and application credentials if unauthorized access is suspected, as this vulnerability facilitates credential harvesting.
• Enable web application firewall (WAF) rules to block HTTP requests containing path traversal sequences (e.g., ../) directed toward the download-content.php endpoint.