CVE-2017-11658

HIGH

WP Rocket 2.9.3 - Path Traversal via Null Byte Bypass

Title source: llm

Description

In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.

References (3)

Core 3

Core References

Exploit, Third Party Advisory x_refsource_misc

https://gist.github.com/Shinkurt/157dbb3767c9489f3d754f79b183a890

Release Notes, Vendor Advisory x_refsource_misc

https://wp-rocket.me/changelog

Third Party Advisory, VDB Entry x_refsource_misc

https://wpvulndb.com/vulnerabilities/8872

Scores

CVSS v3 7.5

EPSS 0.0333

EPSS Percentile 87.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (50)

wp-rocket/wp-rocket 1.3.0

wp-rocket/wp-rocket 1.3.1

wp-rocket/wp-rocket 1.3.2

wp-rocket/wp-rocket 1.3.3

wp-rocket/wp-rocket 1.3.4

wp-rocket/wp-rocket 1.3.5

wp-rocket/wp-rocket 1.3.6

wp-rocket/wp-rocket 1.3.7

wp-rocket/wp-rocket 2.0.0

wp-rocket/wp-rocket 2.0.1

... and 40 more

Published Jul 26, 2017

Tracked Since Feb 18, 2026