The ad-inserter plugin before 2.4.20 for WordPress has path traversal.
Vector
NETWORK
Complexity
LOW
Authentication
NONE
Confidentiality
PARTIAL
Integrity
NONE
Availability
NONE
Ad inserter project Ad inserter 2.4.0 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.1 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.2 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.3 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.4 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.5 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.6 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.7 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.8 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.9 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.10 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.11 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.12 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.13 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.14 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.15 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.16 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.17 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.18 ~~~wordpress~~ (not an official CPE)
Ad inserter project Ad inserter 2.4.19 ~~~wordpress~~ (not an official CPE)
| Advisory | Patch | Confirmed | Link |
|---|---|---|---|
| https://wordpress.org/plugins/ad-inserter/#developers | |||
| https://wpvulndb.com/vulnerabilities/9453 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (ID 22)
Related CAPEC 7
Relative Path Traversal (CAPEC-ID 139)
Directory Traversal (CAPEC-ID 213)
File System Function Injection, Content Based (CAPEC-ID 23)
Using Slashes and URL Encoding Combined to Bypass Validation Logic (CAPEC-ID 64)
Manipulating Input to File System Calls (CAPEC-ID 76)
Using Escaped Slashes in Alternate Encoding (CAPEC-ID 78)
Using Slashes in Alternate Encoding (CAPEC-ID 79)