Path traversal in Cherry Plugin for WordPress lets attackers read files
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Cherry Plugin for WordPress from 1.1 before 1.2.7 contains a path traversal flaw in download-content.php (CWE-22). The script passes the 'file' parameter directly to readfile(), so it does not restrict the path. An unauthenticated remote attacker can send GET requests with traversal sequences to download arbitrary files, such as wp-config.php, which exposes database credentials. Shadowserver Foundation first observed exploitation on 2023-10-19.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cherry Team | Cherry Plugin | 1.1 to before 1.2.7 | 1.2.7 | Patch available | CNA |
- Cherry Plugin VendorCherry Team Affected 1.1 to before 1.2.7 Fixed in 1.2.7 Patch available CNA
Remediation
Update Cherry Plugin for WordPress to version 1.2.7 or later, which fixes the issue. The sources list no vendor advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Cherry Plugin (Cherry Team) Fixed in 1.2.7
Timeline
- 2026-10-20 Threatist record created from CVE-2016-20103
- 2026-10-21 Alias added: GHSA-f9fh-3wgw-qrqr
- 2026-10-22 Priority changed: MEDIUM → LOW
- 2026-10-28 CISA SSVC decision points changed
- 2026-10-28 Priority changed: LOW → HIGH
References
Sources
- CVE-2016-20103 · CVE Program
- CVE-2016-20103 · NVD
- FIRST EPSS
- GHSA-f9fh-3wgw-qrqr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences