CVE-2018-16283: The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.

PriorityP275critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

63.07%

99.1th percentile

The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
wechat_brodcast_project	wechat_brodcast	<= 1.2.0	—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd↗

path/wp-content/plugins/wechat-broadcast/wechat/Image.php↗

→Look for GET requests to Image.php with a 'url' parameter containing directory traversal sequences (../../) in the wechat-broadcast plugin path. ↗
→The vulnerable code echoes unsanitized user input directly via file_get_contents; monitor for responses containing 'root:.*:0:0:' in the body, indicating successful /etc/passwd read. ↗
→Also watch for Remote File Inclusion attempts where the 'url' parameter points to an external HTTP resource (e.g., http://malicious.url/shell.txt). ↗

·The vulnerability is unauthenticated and requires no privileges; any network-accessible WordPress instance with this plugin installed is exposed. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.