Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2008-0196 — Path Traversal in Wordpress
Severity
5.0MEDIUMNVD
EPSS
0.2%
top 52.10%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJan 10
Latest updateMay 1
Description
Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the page parameter to certain PHP scripts under wp-admin/ or (2) the import parameter to wp-admin/admin.php, as demonstrated by discovering the full path via a request for the \..\..\wp-config pathname; and allow remote attackers to modify arbitrary files via a .. (dot dot) in the file parameter to wp-admin/templates.php.
CVSS vector
AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9
Affected Packages3 packages
🔴Vulnerability Details
2💥Exploits & PoCs
1Exploit-DB▶
WordPress Core / MU / Plugins - '/admin.php' Privileges Unchecked / Multiple Information Disclosures↗2009-07-10
📋Vendor Advisories
1Debian▶
CVE-2008-0196: wordpress - Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier all...↗2008