WordPress Plugin Vulnerabilities

eShop Magic 0.1 - eshop-magic/download.php file Parameter Traversal Arbitrary File Access

Description

The Eshop Magic WordPress plugin was affected by an eshop-magic/download.php file Parameter Traversal Arbitrary File Access security vulnerability.

Affects Plugins

Plugin icon
eshop-magic
Fixed in 0.2

References

URL
https://exchange.xforce.ibmcloud.com/vulnerabilities/79222

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22

Miscellaneous

Verified
No
WPVDB ID
2dc9ff7f-4e10-44b3-9523-36687720f725

Timeline

Publicly Published
2014-08-01 (about 11 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2024-12-03
Title
Classic Addons – WPBakery Page Builder < 3.1 - Authenticated (Contributor+) Limited Local PHP File Inclusion
Published
2025-05-14
Title
File Manager Advanced Shortcode <= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode
Published
2023-12-26
Title
Ultimate Addons for Beaver Builder < 1.35.14 - Contributor+ Arbitrary File Download
Published
2023-12-21
Title
Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion
Published
2025-02-17
Title
Keap Official Opt-in Forms < 2.0.2 - Unauthenticated Limited Local File Inclusion