CVE-2017-20287

🗓️ 22 Oct 2026 10:57:22Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Unauthenticated path traversal in Javo Spot WordPress Theme allows reading arbitrary files.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2017-20287	22 Oct 202611:03	–	circl
CNNVD	Javo Spot path traversal vulnerability	22 Oct 202600:00	–	cnnvd
Cvelist	CVE-2017-20287 Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter	22 Oct 202610:57	–	cvelist
EUVD	EUVD-2017-19024	22 Oct 202610:57	–	euvd
NVD	CVE-2017-20287	22 Oct 202611:17	–	nvd
Positive Technologies	PT-2026-121374	22 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2017-20287: Improper Limitation of a Pathname to a Restricted Directory	22 Oct 202600:00	–	rapid7
VulnCheck KEV	VulnCheck KEV: CVE-2017-20287	22 Oct 202600:00	–	vulncheck_kev
Vulnrichment	CVE-2017-20287 Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter	22 Oct 202610:57	–	vulnrichment

Vulners

Node

javothemes javo_spotRange<3.0.0

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Javo Themes",
    "product": "Javo Spot",
    "versions": [
      {
        "version": "0",
        "lessThan": "3.0.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
codeseekah	www.codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability/
vulncheck	www.vulncheck.com/advisories/javo-spot-wordpress-theme-3.0.0-path-traversal-via-admin-ajax-php-fn-parameter
github	www.github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wp-javospot-lfi.yaml
wpscan	www.wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab
themeforest	www.themeforest.net/item/javo-spot-multi-purpose-directory-wordpress-theme/13198068
wpscan	www.wpscan.com/vulnerability/2d465fc4-d4fa-43bb-9c0d-71dcc3ee4eab/

Parameter	Position	Path	Description	CWE
fn	query param	/wp-admin/admin-ajax.php	Path traversal vulnerability in the jvfrm_spot_get_json AJAX action via the 'fn' parameter, allowing unauthenticated attackers to read arbitrary files like wp-config.php.	CWE-22

28 Oct 2026 18:16Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

CVSS 48.7

EPSS0.007

SSVC