CVE-2015-4694

8.6 highEPSS 16%

High (8.6) in zip attachments project zip attachments. EPSS 16% chance of exploitation in the next 30 days.

Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.

Severity

CVSS 3.0

8.6 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS: 16% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2016-01-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zip_attachments_project:zip_attachments

References

http://www.openwall.com/lists/oss-security/2015/06/12/4
http://www.openwall.com/lists/oss-security/2015/06/21/2
http://www.securityfocus.com/bid/75211
http://www.vapid.dhs.org/advisory.php?v=126
https://wordpress.org/plugins/zip-attachments/changelog/

Check your stack JSON