CVE-2016-20103 in Cherry Plugin
Summary
by MITRE • 10/20/2026
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The Cherry Plugin for WordPress prior to version 1.2.7 contains a critical path traversal vulnerability that enables unauthenticated attackers to access sensitive files within the web root directory of any vulnerable installation. This flaw stems from improper input validation in the import-export functionality, specifically within the download-content.php script located at /admin/import-export/download-content.php. The application fails to sanitize or validate the file parameter provided by the user before passing it directly to PHP's readfile function. Consequently, an attacker can manipulate this parameter using directory traversal sequences such as ../../../../../wp-config.php to escape the intended directory scope and access arbitrary files on the server filesystem. This lack of restriction allows for the unauthorized reading of configuration files that typically contain database credentials, API keys, and other sensitive authentication data essential for maintaining the integrity and confidentiality of the WordPress environment.
The operational impact of this vulnerability is severe as it facilitates information disclosure without requiring any form of user authentication or valid session tokens. By exploiting this flaw, an attacker can retrieve the wp-config.php file which houses database connection details including hostnames, usernames, passwords, and security salts. Access to these credentials allows for further exploitation vectors such as direct database access leading to data exfiltration, modification, or destruction. Additionally, if other sensitive files like .htaccess are accessible, attackers might attempt to manipulate server configuration settings. The vulnerability was actively exploited in the wild, with evidence of attacks first observed by the Shadowserver Foundation on October 19, 2023, indicating that automated scanning tools and malicious actors were already targeting this specific weakness shortly after its disclosure or even before public awareness grew significantly.
From a classification perspective, this issue aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements within file names that could cause the path to resolve outside of the intended directory. In terms of offensive security frameworks, this vulnerability maps directly to ATT&CK technique T1083: File and Directory Discovery, as it allows an adversary to enumerate and access files on a compromised system for subsequent exploitation phases such as Credential Access or Data Exfiltration. The direct use of user-supplied input in file operations without sanitization is a classic example of insecure coding practices that lead to predictable remote code execution prerequisites through information leakage.
To mitigate this vulnerability, administrators must immediately upgrade the Cherry Plugin to version 1.2.7 or later where these path traversal checks have been implemented and validated by developers. Until an update can be applied, temporary mitigations include restricting access to the /admin/import-export/ directory via web server configuration rules such as Apache's mod_rewrite or Nginx deny directives if feasible without breaking legitimate functionality. It is also advisable to review server logs for patterns of GET requests containing traversal sequences like ../ targeting download-content.php and block offending IP addresses at the firewall level. Furthermore, ensuring that wp-config.php has strict file permissions set to 400 or 600 can limit exposure even if an attacker successfully retrieves the path, although this is a secondary defense rather than a primary fix for the application logic flaw. Regular security audits and patch management processes are essential to prevent such known vulnerabilities from being exploited in production environments.