Attack Chain

1. Attacker performs reconnaissance to identify websites utilizing the Memphis Documents Library plugin.
2. Attacker crafts a malicious HTTP GET request targeting the mdocs_img_preview() function within mdocs-downloads.php.
3. Attacker injects path traversal sequences (e.g., ../../) into the mdocs-img-preview parameter.
4. The plugin fails to adequately sanitize the user-supplied input, allowing the directory traversal.
5. The server processes the request and retrieves the contents of the requested file outside the web root.
6. The sensitive file content, such as the site configuration, is returned in the HTTP response body to the attacker.
7. Attacker parses the exfiltrated configuration file to extract database credentials.
8. Attacker uses stolen credentials to access or modify the site database.

Impact

Successful exploitation allows unauthenticated attackers to read any file on the underlying server that the web server user has read access to. The primary risk is the theft of the wp-config.php file, leading to the compromise of database credentials and potentially full administrative access to the WordPress application or the underlying hosting environment.

Recommendation

• Update the Memphis Documents Library plugin to version 3.1.6 or later immediately to resolve the vulnerability.
• Audit web server access logs for requests containing suspicious path traversal patterns (e.g., ../) targeting the mdocs-img-preview parameter.
• Review database access logs and application logs for unusual activity following the potential exposure of wp-config.php.