CVE-2015-10136

HIGH

GI-Media Library <3.0 - Path Traversal

Title source: llm

Description

The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Exploits (1)

metasploit WORKING POC

by Unknown · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb

View Code ZIP pw:eip

References (7)

[Broken Link] http://wordpressa.quantika14.com/repository/index.php?id=24

[Product] https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb

[Patch] https://plugins.trac.wordpress.org/changeset/1132677

[Product] https://wordpress.org/plugins/gi-media-library/#developers

[Broken Link] https://wpscan.com/vulnerability/7754

[Third Party Advisory] https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_gimedia_library_file_read/

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=cve

Scores

CVSS v3 7.5

EPSS 0.5472

EPSS Percentile 98.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (2)

zishanj/GI-Media Library < 3.0

zishanj/gi-media-library < 3.0

Published Jul 19, 2025

Tracked Since Feb 18, 2026