CVE-2015-4694

HIGH NUCLEI

Zip Attachments < 1.5 - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.

Nuclei Templates (1)

WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval
HIGHby 0x_Akoko

References (7)

Scores

CVSS v3 8.6
EPSS 0.3251
EPSS Percentile 96.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (1)
zip_attachments_project/zip_attachments < 1.5
Published Jan 08, 2016
Tracked Since Feb 18, 2026