{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atinymce_thumbnail_gallery_projecttinymce_thumbnail_gallerywordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tinymce_thumbnail_gallery_project:tinymce_thumbnail_gallery:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2012-20002"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TinyMCE Thumbnail Gallery (\u003c 1.1.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","path-traversal","wordpress"],"_cs_type":"threat","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe TinyMCE Thumbnail Gallery plugin for WordPress contains a path traversal vulnerability (CVE-2012-20002) in the download-image.php script. This vulnerability enables unauthenticated, remote attackers to bypass directory restrictions and access sensitive files stored on the underlying web server. By providing malicious input to the 'href' parameter, an attacker can traverse the file system to retrieve critical files such as wp-config.php, which contains database credentials and other environment secrets. This vulnerability is significant as it provides a direct path to credential exfiltration and potential secondary exploitation of the WordPress database. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability as early as October 2023.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance on a target WordPress site to identify the use of the vulnerable TinyMCE Thumbnail Gallery plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request targeting the path /wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php.\u003c/li\u003e\n\u003cli\u003eAttacker injects path traversal sequences (e.g., ../../../../) into the 'href' parameter of the request.\u003c/li\u003e\n\u003cli\u003eThe vulnerable script fails to sanitize the 'href' input and processes the request using the provided directory traversal sequences.\u003c/li\u003e\n\u003cli\u003eThe web server process reads the target file from the file system, such as wp-config.php.\u003c/li\u003e\n\u003cli\u003eThe server returns the contents of the requested file in the HTTP response body to the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker parses the returned file to extract sensitive database credentials or other configuration data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read sensitive files on the server. If the target file is wp-config.php, the attacker gains access to database connection strings, database usernames, and passwords. This exposure facilitates unauthorized access to the application data, potentially leading to full site compromise, data exfiltration, or further persistence within the server environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the TinyMCE Thumbnail Gallery plugin to version 1.1.0 or later immediately to address CVE-2012-20002.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to monitor for path traversal attempts targeting the download-image.php script.\u003c/li\u003e\n\u003cli\u003eAudit access logs for previous GET requests to /php/download-image.php containing \u0026quot;..\u0026quot; sequences, which may indicate past exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:52:53Z","date_published":"2026-10-20T21:52:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tinymce-path-traversal/","summary":"The TinyMCE Thumbnail Gallery WordPress plugin versions prior to 1.1.0 are vulnerable to unauthenticated path traversal via the href parameter, allowing remote attackers to read arbitrary system files.","title":"TinyMCE Thumbnail Gallery: Path Traversal Vulnerability (CVE-2012-20002)","url":"https://feed.craftedsignal.io/briefs/2026-10-tinymce-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:tinymce_thumbnail_gallery_project:tinymce_thumbnail_gallery:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}