CVE-2021-39312

HIGHNuclei

True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-39312 has a selected CVSS score of 7.5 (high); EIP currently links 1 catalogued exploit, 1 repository PoC, and 1 Nuclei template.

Description

The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 3, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 31, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

True Ranker

Browse True Ranker / True Ranker
CVE List, VulnCheck2.2.2 to ≤ 2.2.2affected

Proofs of concept

2

Catalogued exploits

ExploitDBWordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)ExploitDB exploitby Liad LevyNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubroot-wav/wordpress-true-ranker-cve-2021-39312Repository PoCby root-wav0Not analyzed3 files

2.5 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHWordPress True Ranker <2.2.4 - Local File InclusionCVSS 7.5

WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file via local file inclusion.

Impact

Unauthenticated attackers can read sensitive configuration files like wp-config.php via local file inclusion, exposing database credentials and WordPress security keys.

Remediation

Fixed in version 2.2.4

WeaknessesCWE-22
AuthorsDhiyaneshDK
Template tagscvecve2021unauthlfrwpscanwp-pluginlfiwpwordpresstruerankervkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:trueranker:true_ranker:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/d48e723c-e3d1-411e-ab8e-629fe1606c79 https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39312 https://plugins.trac.wordpress.org/browser/seo-local-rank/tags/2.2.2/admin/vendor/datatables/examples/resources/examples.php https://nvd.nist.gov/vuln/detail/CVE-2021-39312 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4