{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/aspose-doc-exporter--2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aspose:aspose_doc_exporter:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2015-20123"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Aspose Doc Exporter (\u003c 2.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","path-traversal","web-exploitation"],"_cs_type":"threat","_cs_vendors":["Aspose"],"content_html":"\u003cp\u003eThe Aspose Doc Exporter plugin for WordPress, specifically versions prior to 2.0, contains a path traversal vulnerability originating from improper input sanitization in the \u003ccode\u003ereadfile()\u003c/code\u003e function. The flaw allows unauthenticated remote attackers to bypass directory restrictions and access arbitrary files on the web server. By crafting malicious GET requests to the \u003ccode\u003easpose_doc_exporter_download.php\u003c/code\u003e script and manipulating the \u003ccode\u003efile\u003c/code\u003e parameter, an attacker can traverse the directory structure to retrieve sensitive configuration files, such as \u003ccode\u003ewp-config.php\u003c/code\u003e. Access to this file typically results in the exposure of database credentials, which can lead to full site takeover or further internal network compromise. This vulnerability has been subject to active exploitation in the wild since at least October 2023.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify sites running the vulnerable Aspose Doc Exporter WordPress plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET request targeting the \u003ccode\u003easpose_doc_exporter_download.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker appends a malicious path traversal string to the \u003ccode\u003efile\u003c/code\u003e parameter (e.g., \u003ccode\u003e../../../wp-config.php\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe web server processes the request and executes the \u003ccode\u003ereadfile()\u003c/code\u003e function with the unsanitized user input.\u003c/li\u003e\n\u003cli\u003eThe application returns the contents of the target system file in the HTTP response body.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response to extract cleartext database credentials or other sensitive configuration data.\u003c/li\u003e\n\u003cli\u003eAttacker uses stolen credentials to access the backend database or authenticates as a high-privileged user.\u003c/li\u003e\n\u003cli\u003eAttacker achieves unauthorized access to the application data or proceeds with further lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read sensitive server-side files. For WordPress environments, the most common target is \u003ccode\u003ewp-config.php\u003c/code\u003e, which contains hardcoded database host, username, and password information. This exposure enables attackers to modify the database, inject malicious content into the site, or exfiltrate customer data, leading to total site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Aspose Doc Exporter plugin to version 2.0 or later immediately to apply the vendor-provided patch.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests to \u003ccode\u003easpose_doc_exporter_download.php\u003c/code\u003e containing directory traversal patterns like \u003ccode\u003e../\u003c/code\u003e, \u003ccode\u003e..%2f\u003c/code\u003e, or \u003ccode\u003e..%5c\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUse the Sigma rule provided below to detect exploitation attempts targeting this specific endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:53:15Z","date_published":"2026-10-20T21:53:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aspose-doc-exporter-traversal/","summary":"The Aspose Doc Exporter WordPress plugin before version 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server.","title":"Aspose Doc Exporter: Path traversal vulnerability (CVE-2015-20123)","url":"https://feed.craftedsignal.io/briefs/2026-10-aspose-doc-exporter-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Aspose Doc Exporter (\u003c 2.0)","version":"https://jsonfeed.org/version/1.1"}