CVE-2015-5482
dev4press gd bbpress attachments: no CVSS score yet. EPSS 1.8% chance of exploitation in the next 30 days.
Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dev4press:gd_bbpress_attachments
References
- https://packetstormsecurity.com/files/132656/wpgdbbpress-lfi.txt
- https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/
- https://wordpress.org/plugins/gd-bbpress-attachments/changelog/
- https://wpvulndb.com/vulnerabilities/8087
- https://packetstormsecurity.com/files/132656/wpgdbbpress-lfi.txt