CVE-2015-4694

HIGH NUCLEI

Zip Attachments < 1.5 - Path Traversal via za_file Parameter

Title source: llm

Exploitation Summary

CVE-2015-4694 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the za_file parameter.

Nuclei Templates (1)

WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval

HIGHby 0x_Akoko

References (7)

Core 7

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/75211

Patch, Vendor Advisory x_refsource_confirm

https://wordpress.org/plugins/zip-attachments/changelog/

Third Party Advisory x_refsource_misc

https://wpvulndb.com/vulnerabilities/8047

Exploit mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2015/06/21/2

Exploit x_refsource_misc

http://www.vapid.dhs.org/advisory.php?v=126

Exploit mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2015/06/12/4

Product x_refsource_misc

https://wordpress.org/support/topic/zip-attachments-wordpress-plugin-v114-arbitrary-file-download-vulnerability?replies=1

Scores

CVSS v3 8.6

EPSS 0.3251

EPSS Percentile 97.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (1)

zip_attachments_project/zip_attachments < 1.5

Published Jan 08, 2016

Tracked Since Feb 18, 2026