Read the docs
TI-2015-08115 Aliases CVE-2015-20125GHSA-p7cr-5mhm-8gc2

Path traversal in Aspose PDF Exporter WordPress plugin lets attackers read files

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

The Aspose PDF Exporter plugin for WordPress from 1.0 before 2.0 contains a path traversal flaw in which the unsanitized 'file' parameter is passed to readfile(). An unauthenticated remote attacker can send GET requests with traversal sequences to download arbitrary files, such as wp-config.php containing WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00412 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Aspose PDF Exporter (Aspose): 2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AsposeAspose PDF Exporter1.0 to before 2.02.0Patch availableCNA
  • Aspose PDF Exporter VendorAspose Affected 1.0 to before 2.0 Fixed in 2.0 Patch available CNA

Remediation

Update Aspose PDF Exporter to version 2.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Aspose PDF Exporter (Aspose) Fixed in 2.0

Timeline

  1. 2026-10-20 Threatist record created from CVE-2015-20125
  2. 2026-10-21 Alias added: GHSA-p7cr-5mhm-8gc2
  3. 2026-10-22 Priority changed: MEDIUM → LOW
  4. 2026-10-28 CISA SSVC decision points changed
  5. 2026-10-28 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2015-08114 Path traversal in Aspose Importer & Exporter WordPress plugin CVSS 4.0HIGH 8.7
  • TI-2015-08113 Path traversal in Aspose Doc Exporter WordPress plugin lets attackers read files CVSS 4.0HIGH 8.7
  • TI-2019-03528 Use after free in Talos Aspose CVSS 3.1CRITICAL 9.8
  • TI-2019-03527 Use after free in Talos Aspose CVSS 3.1CRITICAL 9.8
  • TI-2019-03504 Stack-based buffer overflow in Aspose CVSS 3.1HIGH 8.8
  • TI-2019-03496 Out-of-bounds read in Aspose CVSS 3.1HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences