CVE-2015-5609

9.1 criticalEPSS 3.2%

Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.

Severity

CVSS 3.0

9.1 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2017-05-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

image-export_project:image-export

References

http://www.openwall.com/lists/oss-security/2015/07/13/10
http://www.openwall.com/lists/oss-security/2015/07/21/1
http://www.vapid.dhs.org/advisory.php?v=135
http://www.openwall.com/lists/oss-security/2015/07/13/10
http://www.openwall.com/lists/oss-security/2015/07/21/1

Check your stack JSON