CVE-2015-10136

HIGH

GI-Media Library <3.0 - Path Traversal

Title source: llm

Description

The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Exploits (1)

metasploit WORKING POC

by Unknown · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb

View Code ZIP pw:eip

References (7)

[Broken Link] http://wordpressa.quantika14.com/repository/index.php?id=24

[Product] https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb

[Patch] https://plugins.trac.wordpress.org/changeset/1132677

[Product] https://wordpress.org/plugins/gi-media-library/#developers

[Broken Link] https://wpscan.com/vulnerability/7754

[Third Party Advisory] https://www.rapid7.com/db/modules/auxiliary/scanner/http/wp_gimedia_library_file_read/

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=cve

Scores

CVSS v3 7.5

EPSS 0.4860

EPSS Percentile 97.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-22

Status published

Affected Products (1)

zishanj/gi-media-library < 3.0

Timeline

Published Jul 19, 2025

Tracked Since Feb 18, 2026