WordPress Plugin Vulnerabilities

Zip Attachments < 1.5 - Arbitrary File Download

Description

The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file.

Proof of Concept

Affects Plugins

Plugin icon
zip-attachments
Fixed in 1.5

References

CVE
CVE-2015-4694

Miscellaneous

Submitter
Larry W. Cashdollar
Submitter twitter
_larry0
Verified
No
WPVDB ID
8bae9672-ec37-4a35-99c5-7bd81c9b9bf6

Timeline

Publicly Published
2015-06-12 (about 10 years ago)
Added
2015-06-15 (about 10 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2019-01-25
Title
Total Donations - Update Arbitrary WordPress Option Values
Published
2017-07-25
Title
Stop User Enumeration <= 1.3.8 - REST API Bypass
Published
2020-02-25
Title
Flexible Checkout Fields for WooCommerce < 2.3.2 - Unauthenticated Settings Update
Published
2016-02-04
Title
User Meta Manager <= 3.4.6 - Privilege Escalation
Published
2015-04-06
Title
QAEngine Theme - Privilege Escalation