Aspose - CraftedSignal Threat Feed

Aspose PDF Exporter: Path traversal vulnerability (CVE-2015-20125)

hello@craftedsignal.io — Tue, 20 Oct 2026 21:53:28 +0000

The Aspose PDF Exporter plugin for WordPress, in versions prior to 2.0, contains a path traversal vulnerability. This security flaw stems from the unsanitized input handled by the 'file' parameter within the 'aspose_pdf_exporter_download.php' script, which utilizes the 'readfile()' PHP function. Unauthenticated remote attackers can exploit this vulnerability by submitting specially crafted GET requests containing directory traversal sequences (e.g., ../) to the affected script. Successful exploitation allows an attacker to bypass file system restrictions and read sensitive files from the underlying server, such as 'wp-config.php', which typically contains database credentials. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability as early as October 2023. Organizations using this plugin must upgrade to version 2.0 or later to remediate the issue.

Impact

Successful exploitation of this vulnerability leads to the disclosure of sensitive server-side files, including WordPress configuration files containing database credentials. This can result in full database compromise, unauthorized administrative access to the WordPress instance, and further exploitation of the host environment.

Recommendation

Update the Aspose PDF Exporter plugin to version 2.0 or later immediately to address CVE-2015-20125.
Deploy the provided Sigma rule to detect attempts to access sensitive files using directory traversal sequences against the affected download script.
Audit web server access logs for anomalous GET requests targeting 'aspose_pdf_exporter_download.php' with path traversal patterns (e.g., '../').

Aspose Importer & Exporter: Path traversal vulnerability (CVE-2015-20124)

hello@craftedsignal.io — Tue, 20 Oct 2026 21:53:21 +0000

The Aspose Importer & Exporter plugin for WordPress, in versions prior to 3.0, is vulnerable to a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the underlying server filesystem. The vulnerability exists due to improper sanitization of the 'file' parameter within the 'aspose_import_export_download.php' script. By providing a crafted path containing directory traversal sequences (such as '../'), an attacker can escape the web root and access sensitive system or application files, including 'wp-config.php', which typically contains database credentials and encryption salts. This vulnerability has been subject to active exploitation in the wild, as noted by the Shadowserver Foundation.

Impact

Successful exploitation allows for the unauthorized disclosure of sensitive server-side files. Access to 'wp-config.php' can lead to full compromise of the WordPress site, including complete database access, which may be leveraged to inject malicious content, create administrative accounts, or extract sensitive user data.

Recommendation

Upgrade the Aspose Importer & Exporter plugin to version 3.0 or later immediately.
Review web server access logs for requests containing directory traversal sequences directed at 'aspose_import_export_download.php'.
Perform a security audit of site configurations if the plugin was installed and exposed to the internet.
Deploy the provided Sigma rule to detect and alert on exploitation attempts against this endpoint.

Aspose Doc Exporter: Path traversal vulnerability (CVE-2015-20123)

hello@craftedsignal.io — Tue, 20 Oct 2026 21:53:15 +0000

The Aspose Doc Exporter plugin for WordPress, specifically versions prior to 2.0, contains a path traversal vulnerability originating from improper input sanitization in the readfile() function. The flaw allows unauthenticated remote attackers to bypass directory restrictions and access arbitrary files on the web server. By crafting malicious GET requests to the aspose_doc_exporter_download.php script and manipulating the file parameter, an attacker can traverse the directory structure to retrieve sensitive configuration files, such as wp-config.php. Access to this file typically results in the exposure of database credentials, which can lead to full site takeover or further internal network compromise. This vulnerability has been subject to active exploitation in the wild since at least October 2023.

Attack Chain

Attacker performs reconnaissance to identify sites running the vulnerable Aspose Doc Exporter WordPress plugin.
Attacker crafts an HTTP GET request targeting the aspose_doc_exporter_download.php endpoint.
Attacker appends a malicious path traversal string to the file parameter (e.g., ../../../wp-config.php).
The web server processes the request and executes the readfile() function with the unsanitized user input.
The application returns the contents of the target system file in the HTTP response body.
Attacker parses the response to extract cleartext database credentials or other sensitive configuration data.
Attacker uses stolen credentials to access the backend database or authenticates as a high-privileged user.
Attacker achieves unauthorized access to the application data or proceeds with further lateral movement.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive server-side files. For WordPress environments, the most common target is wp-config.php, which contains hardcoded database host, username, and password information. This exposure enables attackers to modify the database, inject malicious content into the site, or exfiltrate customer data, leading to total site compromise.

Recommendation

Update the Aspose Doc Exporter plugin to version 2.0 or later immediately to apply the vendor-provided patch.
Monitor web server logs for requests to aspose_doc_exporter_download.php containing directory traversal patterns like ../, ..%2f, or ..%5c.
Use the Sigma rule provided below to detect exploitation attempts targeting this specific endpoint.