CVE-2011-1669

no score yetEPSS 22%

Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F (encoded dot dot) sequences in the url parameter.

EPSS: 22% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2011-04-10
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mikoviny:wp_custom_pages

References

http://osvdb.org/71707
http://secunia.com/advisories/43963
http://www.autosectools.com/Advisories/WordPress.WP.Custom.Pages.0.5.0.1_Local.File.Inclusion_169.html
http://www.exploit-db.com/exploits/17119
http://www.securityfocus.com/bid/47146

Check your stack JSON