CVE-2012-3588

Wordpress Plugin Newsletter Plugin - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Sammy FORGIT · textwebappsphp

https://www.exploit-db.com/exploits/19018

View Code ZIP pw:eip

References (4)

[Vendor Advisory] http://secunia.com/advisories/49464

[Exploit] http://www.exploit-db.com/exploits/19018

[Exploit] http://www.opensyscom.fr/Actualites/wordpress-plugins-plugin-newsletter-remote-file-disclosure-vulnerability.html

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/76171

Scores

EPSS 0.1183

EPSS Percentile 93.6%

Classification

CWE

CWE-22

Status draft

Affected Products (1)

wordpress/plugin_newsletter_plugin

Timeline

Published Jun 19, 2012

Tracked Since Feb 18, 2026