CVE-2015-20123 in Doc Exporter Plugin
Summary
by MITRE • 10/21/2026
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The Aspose Doc Exporter plugin for WordPress, prior to version 2.0, contains a critical path traversal vulnerability that stems from insufficient input validation within its file handling mechanisms. This flaw allows unauthenticated attackers to access and download arbitrary files from the underlying server filesystem by manipulating the 'file' parameter in HTTP GET requests directed at aspose_doc_exporter_download.php. The core technical issue lies in the direct usage of unsanitized user-supplied path data passed directly into PHP's readfile() function without adequate checks for directory traversal sequences or canonicalization errors. This lack of sanitization enables an attacker to construct malicious payloads using relative path notation, such as ../../../wp-config.php, which bypasses intended access controls and forces the application to serve sensitive configuration files located outside the plugin’s designated public directories.
The operational impact of this vulnerability is severe due to its unauthenticated nature, meaning no valid credentials are required for exploitation. Attackers can systematically enumerate paths or target known high-value targets like wp-config.php to extract database connection strings containing plaintext usernames and passwords. The compromise of these credentials typically leads to full database access, allowing the extraction of user data, administrative accounts, and site content. Furthermore, if the server environment permits further interaction with retrieved files, this initial foothold can serve as a pivot point for more advanced attacks, including remote code execution or complete website defacement. Evidence of active exploitation was first observed by the Shadowserver Foundation on October 23, 2023, indicating that threat actors are actively scanning and exploiting this specific weakness in the wild against vulnerable WordPress installations.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it involves accessing files outside the restricted directory through path manipulation. In terms of tactical behavior, the exploitation method corresponds to ATT&CK technique T1083: File and Directory Discovery, where adversaries search for specific configuration or sensitive data files on compromised systems. The ability to read arbitrary files also touches upon CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, as it results in the leakage of confidential system configurations and credentials.
To mitigate this risk, administrators should immediately update the Aspose Doc Exporter plugin to version 2.0 or later, where these input validation issues have been addressed by implementing strict allowlists for permitted file extensions and enforcing canonical path checks before passing data to readfile(). For sites unable to upgrade immediately due to compatibility concerns, temporary mitigation strategies include restricting access to aspose_doc_exporter_download.php via web server configuration rules such as Apache’s mod_rewrite or Nginx deny directives. Additionally, ensuring that wp-config.php is placed outside the web root directory and has restrictive file permissions can reduce the impact of successful exploitation by preventing direct HTTP retrieval even if path traversal succeeds. Regular monitoring for unusual outbound traffic patterns related to large file downloads from plugin directories may also aid in early detection of ongoing attacks targeting this vulnerability.